4 ms·

Could be worse! Seattle.gov started serving with HSTS `includeSubDomains; preload` over a month ago, broke all sorts of subdomains, and are still picking up th

Could be worse! Seattle.gov started serving with HSTS `includeSubDomains; preload` over a month ago, broke all sorts of subdomains, and are still picking up the pieces. City council ordinances and resolutions are hosted at http://clerk.seattle.gov/ http://clerk.seattle.gov/, not that it matters, since you can't view the site.

andersa 3y ago
After getting a popup about it not being secure, I can visit this site just fine in latest Chrome.
askiiart 3y ago
I can view the HTTP version of the site just fine, but I seem to get stuck when trying it over HTTPS.
Cyphase 3y ago
To those saying you can view the site; it's presumably because you didn't go to seattle.gov when it was setting HSTS on subdomains. Presumably the parent did and is now not able to access http://clerk.seattle.gov/ http://clerk.seattle.gov/ because of that.
Espionage724 3y ago
That site loads fine for me in Firefox. I like how Seattle has their own ordinance site; I don't know how other places do it, but the town I'm in uses eCode360
- deleted 3y ago
  [deleted]
1vuio0pswjnm7 3y ago
x=clerk.seattle.gov printf 'GET / HTTP/1.1\r\nHost: '$x'\r\nConnection: close\r\n\r\n' \ |nc -vvn 156.74.251.24 80 There's a line in the fwd proxy config for these rare situations where I need to use HTTP without TLS use_backend b407-notls if { hdr(host) -m str -f /somedir/hosts-notls.txt } Normally the proxy will use TLS for any request from any application, not just a web browser, regardless of whether URL begins with http:// http:// or whether it's sent to port 80 To avoid HSTS supercookies^1 I can also add a response header http-response add-header Strict-Transport-Security max-age=0 but I have not needed to do that. 1. https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-browser-dilemma-how-hsts-supercookies-make-you-choose-between-privacy-or-security/ https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-bro... If the site is on some pre-approved list compiled into the browser, I can remove it and recompile. But I am not interested in such user-hostile browsers for frequent use. Good for online shopping, banking, other commercial transactions, but not for non-commercial purposes. The ubiquity of TLS is of course a relatively recent phenomena It seems like Internet Archive still does lots of crawls of port 80; I wonder if that's also true for Common Crawl If so, it's interesting to think about how much of the data used to train ChatGPT and other AI may have come from crawls over port 80 On ChatGPT data sources: https://www.searchenginejournal.com/how-to-block-chatgpt-from-using-your-website-content/478384/ https://www.searchenginejournal.com/how-to-block-chatgpt-fro...
tinus_hn 3y ago
So now all of their public sites will have to implement https. Seems like a win to me.

andersa 3y ago

After getting a popup about it not being secure, I can visit this site just fine in latest Chrome.

askiiart 3y ago

I can view the HTTP version of the site just fine, but I seem to get stuck when trying it over HTTPS.

Cyphase 3y ago

To those saying you can view the site; it's presumably because you didn't go to seattle.gov when it was setting HSTS on subdomains. Presumably the parent did and is now not able to access http://clerk.seattle.gov/ http://clerk.seattle.gov/ because of that.

Espionage724 3y ago

That site loads fine for me in Firefox. I like how Seattle has their own ordinance site; I don't know how other places do it, but the town I'm in uses eCode360

deleted 3y ago
[deleted]

1vuio0pswjnm7 3y ago

x=clerk.seattle.gov printf 'GET / HTTP/1.1\r\nHost: '$x'\r\nConnection: close\r\n\r\n' \ |nc -vvn 156.74.251.24 80 There's a line in the fwd proxy config for these rare situations where I need to use HTTP without TLS use_backend b407-notls if { hdr(host) -m str -f /somedir/hosts-notls.txt } Normally the proxy will use TLS for any request from any application, not just a web browser, regardless of whether URL begins with http:// http:// or whether it's sent to port 80 To avoid HSTS supercookies^1 I can also add a response header http-response add-header Strict-Transport-Security max-age=0 but I have not needed to do that. 1. https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-browser-dilemma-how-hsts-supercookies-make-you-choose-between-privacy-or-security/ https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-bro... If the site is on some pre-approved list compiled into the browser, I can remove it and recompile. But I am not interested in such user-hostile browsers for frequent use. Good for online shopping, banking, other commercial transactions, but not for non-commercial purposes. The ubiquity of TLS is of course a relatively recent phenomena It seems like Internet Archive still does lots of crawls of port 80; I wonder if that's also true for Common Crawl If so, it's interesting to think about how much of the data used to train ChatGPT and other AI may have come from crawls over port 80 On ChatGPT data sources: https://www.searchenginejournal.com/how-to-block-chatgpt-from-using-your-website-content/478384/ https://www.searchenginejournal.com/how-to-block-chatgpt-fro...

tinus_hn 3y ago

So now all of their public sites will have to implement https. Seems like a win to me.