<story><title>Chrome to force .dev domains to HTTPS via preloaded HSTS</title><url>https://ma.ttias.be/chrome-force-dev-domains-https-via-preloaded-hsts/</url></story><parent_chain><item><author>CydeWeys</author><text>Hey everyone.  I&amp;#x27;m the Tech Lead of Google Registry and I&amp;#x27;m the one behind this (and likely future) additions to the HSTS preload list.  I might be able to answer some questions people have.&lt;p&gt;But to pre-emptively answer the most likely question: We see HTTPS everywhere as being fundamental to improving security of the Web.  Ideally all websites everywhere would use HTTPS, but there&amp;#x27;s decades of inertia of that not being the case.  HSTS is one tool to help nudge things towards an HTTPS everywhere future, which has really only become possible in the last few years thanks to the likes of Let&amp;#x27;s Encrypt.</text></item></parent_chain><comment><author>hungerstrike</author><text>I bet you can&amp;#x27;t answer the actual most likely question: What are you (Google) planning on doing with .dev domains anyway?&lt;p&gt;However besides that...just curious: Will Chrome honor a header to disable HSTS for preloaded domains? (e.g. &lt;i&gt;Strict-Transport-Security: max-age=0&lt;/i&gt;)? And what is going to happen if I submit my .dev site for removal from &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;hstspreload.org&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;hstspreload.org&amp;#x2F;&lt;/a&gt; ?&lt;p&gt;Also, reading the rules on hstspreload.org, I see the following statement: &lt;i&gt;&amp;quot;Don&amp;#x27;t request inclusion unless you&amp;#x27;re sure that you can support HTTPS for your entire site and all its subdomains the long term&amp;quot;&lt;/i&gt;&lt;p&gt;Since you cannot actually guarantee that every .dev site will support HTTPS considering the fact that many developers use it on their LAN...don&amp;#x27;t you think you&amp;#x27;re breaking the rules here and possibly causing more problems than solutions?</text></comment>
<story><title>Chrome to force .dev domains to HTTPS via preloaded HSTS</title><url>https://ma.ttias.be/chrome-force-dev-domains-https-via-preloaded-hsts/</url></story><parent_chain><item><author>CydeWeys</author><text>Hey everyone.  I&amp;#x27;m the Tech Lead of Google Registry and I&amp;#x27;m the one behind this (and likely future) additions to the HSTS preload list.  I might be able to answer some questions people have.&lt;p&gt;But to pre-emptively answer the most likely question: We see HTTPS everywhere as being fundamental to improving security of the Web.  Ideally all websites everywhere would use HTTPS, but there&amp;#x27;s decades of inertia of that not being the case.  HSTS is one tool to help nudge things towards an HTTPS everywhere future, which has really only become possible in the last few years thanks to the likes of Let&amp;#x27;s Encrypt.</text></item></parent_chain><comment><author>panic</author><text>One of greatest things about the Web is how easy it is to write HTTP clients and servers.  I see why HTTPS everywhere would be helpful, but I also think it would be a shame to lose this simplicity.  Has there been any thought put toward simpler alternatives to HTTP+TLS?</text></comment>