Post

Kevin Deng
@sxzz.dev

TIL: Domains like .dev, .app are required to use HTTPS.

1 repost8 likes

fry69
@fry69.dev

I guess with plain HTTP you will not have a good time on the internet anymore, outside localhost and very specialized networks/IoT (maybe)

Kevin Deng
@sxzz.dev

I was reading about the HSTS preload list today, and one thing that caught me by surprise is that whether HTTPS is enforced seems to depend on the TLD.

fry69
@fry69.dev

This could lead to some surprises, indeed. E.g. if you use such a TLD domain for organizing a private network for plain HTTP to talk to IoT thingies (ESP32?), which still often do not really like talking TLS.

Kevin Deng
@sxzz.dev

I think that’s mostly a browser concern. IoT clients generally don’t implement HSTS (or preload lists), so they can still talk over plain HTTP even if a browser would automatically upgrade the same hostname to HTTPS.