Hacker News Reader

Comment by justinsaccount | Hacker News Reader

Weird..

  $ curl https://techblog.netflix.com/2016/08/netflix-and-fill.html -vv
  *   Trying 2607:f8b0:4002:c06::d6...
  * Connected to techblog.netflix.com (2607:f8b0:4002:c06::d6) port 443 (#0)
  * Server aborted the SSL handshake
  * Closing connection 0
  curl: (35) Server aborted the SSL handshake

Fails from at least the 3 locations I just tried across the country.. Google outage?

View on HN

This gets mentioned every time a blogpost from Netflix appears on HN. I've mentioned it too! https://news.ycombinator.com/item?id=12217900

According to kpcyrd, this is what happens: " I have the same issue, even though the link actually is http, my browser tries to open the https version, no matter what. It looks like https://netflix.com had hsts with includeSubdomains at one point in time which my browser has still cached. "

Which is why you should only enable HSTS if you plan on supporting it permanently.

"But there's no reason to not use HTTPS! What could go wrong?"

But, you know... we have to secure our blog posts from MitM...

No, you have to secure your blog posts because cookies against the top level domain can be in the request headers sent to the subdomain[1].

It's a bit bizarre you'd blame HTTPS, what is your alternative, don't use https?

[1] I say "can" because it depends on how the top level cookie is set, whether the browser respects the secure flag, and individual browser versions.

Why do you use HTTPS? The link is HTTP, their blog doesn't support HTTPS.

Ah.. https everywhere seems to think it should support it.

Oddly have never had a problem with it until now.

Their blog is directing me to an HTTPS link when I go to "techblog.netflix.com". It does it even when I specify HTTP.

Do you have https everywhere installed too?

No. Firefox seems to be doing this on its own.

If you're running NoScript, check its settings. See: https://news.ycombinator.com/item?id=12256270#12257702

That did it, thanks. I would not have expected NoScript to be doing things like that.

Reply on news.ycombinator.com