Hacker News Reader

Comment by CydeWeys | Hacker News Reader

Hey everyone, I'm the author of the linked blog post. I can hopefully answer any questions anyone might have. I wrote this post to clarify our overall strategy and intent in response to some of the confusion surrounding our addition of .dev and .foo to the HSTS preload list; see https://news.ycombinator.com/item?id=15268701 for what that was like.

View on HN

Seeing progress on this ticket would be really helpful:

https://issuetracker.google.com/issues/62051227

I will try to see if I can go make something happen. Thanks for the link. I will say that one benefit of TLD-wide HSTS is that you don't have to worry about configuring these headers on a per-domain basis; you're already covered.

Why did Chrome make it take an extra step or two to look at the issuer of a certificate?

No idea. I'm not on the Chrome team. I will say that the best way to find out this info (and more) now is to hit F12/Cmd-Opt-I/whatever to open up the Developer console, and then go to the Security tab. You can see the SSL certificate in there along with lots of other useful security information that wasn't as easily findable from the previous method.

So if I had to guess, it's that they wanted to display more security-related information, which made sense in the developer console but not on the certificate screen. And that viewing the certificate was confusing non-technical web users.

Can you tell them to change it back? It's absolutely annoying.

Edit: http://www.herongyang.com/PKI/Chrome-40-HTTPS-Certificate-Ge...

The old screen showed the same information as in the "Security" tab. Right now a click on the "Secure" button in the URL bar doesn't even show the certificate issuer. It is useless this way.

At least there is an active bug about this: https://bugs.chromium.org/p/chromium/issues/detail?id=663971

chrome://flags/#show-cert-link

Thanks

One of the requirements is that you have to actually add a chain redirect to the www subdomain if a dns record for that subdomain exists.

That’s actually not a very good practice. You’ll get http non-www to http www to HTTPs www,for example.

Why is this a requirement for the preload list?

See the following links:

https://github.com/chromium/hstspreload/issues/87

https://bugs.chromium.org/p/chromium/issues/detail?id=626180

Reply on news.ycombinator.com