4 ms·

Interesting stuff. Did HSTS seem out of place to anyone else? Not that it's not important, but compared to the rest of them, it hardly seems like it "changed ev

Interesting stuff. Did HSTS seem out of place to anyone else? Not that it's not important, but compared to the rest of them, it hardly seems like it "changed everything." And from the gut, I'd guess that CORS has done more than HSTS to reduce harm on the internet.

dfern 3y ago
Not to mention Let's Encrypt...
- edgyquant 3y ago
  Let’s encrypt was a huge quality of life saver of working with certificates before. They fully automated the process for the most popular servers.
GuB-42 3y ago
Like most bits of code in the article, they are more like a symbol that represents something that "changed everything" rather than code that actually matters. HSTS is not that important in itself, but it represents the general transition to "all https". Before that, https existed, but it was only used in select cases, like for entering your credit card number, early browsers even had a warning when https was enabled. Nowadays, https is the expected default, browsers are starting the throw a fit when they see plain http, and many tech-savvy users will go "Seriously, http? We are in the 21th century you know". More generally, the need for encryption-by-default also represents how the web is tied to the real world now. People use it to deal with real money, sign contracts, and exchange secrets that have real life consequences if they fall into the wrong hands. The author picked a bit of code to represent that, and he chose the HSTS header. Debatable, but I think it is a good choice.