Post

fry69
@fry69.dev

I guess with plain HTTP you will not have a good time on the internet anymore, outside localhost and very specialized networks/IoT (maybe)

0 reposts1 like

Kevin Deng
@sxzz.dev

I was reading about the HSTS preload list today, and one thing that caught me by surprise is that whether HTTPS is enforced seems to depend on the TLD.

fry69
@fry69.dev

This could lead to some surprises, indeed. E.g. if you use such a TLD domain for organizing a private network for plain HTTP to talk to IoT thingies (ESP32?), which still often do not really like talking TLS.

Kevin Deng
@sxzz.dev

I think that’s mostly a browser concern. IoT clients generally don’t implement HSTS (or preload lists), so they can still talk over plain HTTP even if a browser would automatically upgrade the same hostname to HTTPS.

fry69
@fry69.dev

I think it can still happen that a browser will try to access an IoT device directly via HTTP (w/o TLS), as part of a data fetching API call, then the browser will refuse. But then again, in those cases plain local network IP addresses get used, instead of "clean" DNS names, I guess.