Post

TIL: Domains like .dev, .app are required to use HTTPS.

I guess with plain HTTP you will not have a good time on the internet anymore, outside localhost and very specialized networks/IoT (maybe)

I was reading about the HSTS preload list today, and one thing that caught me by surprise is that whether HTTPS is enforced seems to depend on the TLD.

This could lead to some surprises, indeed. E.g. if you use such a TLD domain for organizing a private network for plain HTTP to talk to IoT thingies (ESP32?), which still often do not really like talking TLS.

I think that’s mostly a browser concern. IoT clients generally don’t implement HSTS (or preload lists), so they can still talk over plain HTTP even if a browser would automatically upgrade the same hostname to HTTPS.