Post

TIL: Domains like .dev, .app are required to use HTTPS.

I guess with plain HTTP you will not have a good time on the internet anymore, outside localhost and very specialized networks/IoT (maybe)

I was reading about the HSTS preload list today, and one thing that caught me by surprise is that whether HTTPS is enforced seems to depend on the TLD.

I think that’s mostly a browser concern. IoT clients generally don’t implement HSTS (or preload lists), so they can still talk over plain HTTP even if a browser would automatically upgrade the same hostname to HTTPS.

I think it can still happen that a browser will try to access an IoT device directly via HTTP (w/o TLS), as part of a data fetching API call, then the browser will refuse. But then again, in those cases plain local network IP addresses get used, instead of "clean" DNS names, I guess.