Post

TIL: Domains like .dev, .app are required to use HTTPS.

I guess with plain HTTP you will not have a good time on the internet anymore, outside localhost and very specialized networks/IoT (maybe)

I was reading about the HSTS preload list today, and one thing that caught me by surprise is that whether HTTPS is enforced seems to depend on the TLD.

This could lead to some surprises, indeed. E.g. if you use such a TLD domain for organizing a private network for plain HTTP to talk to IoT thingies (ESP32?), which still often do not really like talking TLS.

I think it can still happen that a browser will try to access an IoT device directly via HTTP (w/o TLS), as part of a data fetching API call, then the browser will refuse. But then again, in those cases plain local network IP addresses get used, instead of "clean" DNS names, I guess.