Post

TIL: Domains like .dev, .app are required to use HTTPS.

I guess with plain HTTP you will not have a good time on the internet anymore, outside localhost and very specialized networks/IoT (maybe)

This could lead to some surprises, indeed. E.g. if you use such a TLD domain for organizing a private network for plain HTTP to talk to IoT thingies (ESP32?), which still often do not really like talking TLS.

I think that’s mostly a browser concern. IoT clients generally don’t implement HSTS (or preload lists), so they can still talk over plain HTTP even if a browser would automatically upgrade the same hostname to HTTPS.

I think it can still happen that a browser will try to access an IoT device directly via HTTP (w/o TLS), as part of a data fetching API call, then the browser will refuse. But then again, in those cases plain local network IP addresses get used, instead of "clean" DNS names, I guess.