Seattle.gov started serving with HSTS `includeSubDomains; preload` over a month ago, broke all sorts of subdomains, and are still picking up the pieces.
City council ordinances and resolutions are hosted at http://clerk.seattle.gov/, not that it matters, since you can't view the site.
x=clerk.seattle.gov
printf 'GET / HTTP/1.1\r\nHost: '$x'\r\nConnection: close\r\n\r\n' \
|nc -vvn 156.74.251.24 80
use_backend b407-notls if { hdr(host) -m str -f /somedir/hosts-notls.txt }
To avoid HSTS supercookies^1 I can also add a response header
http-response add-header Strict-Transport-Security max-age=0
1. https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-bro...
If the site is on some pre-approved list compiled into the browser, I can remove it and recompile. But I am not interested in such user-hostile browsers for frequent use. Good for online shopping, banking, other commercial transactions, but not for non-commercial purposes.
The ubiquity of TLS is of course a relatively recent phenomena
It seems like Internet Archive still does lots of crawls of port 80; I wonder if that's also true for Common Crawl
If so, it's interesting to think about how much of the data used to train ChatGPT and other AI may have come from crawls over port 80
On ChatGPT data sources:
https://www.searchenginejournal.com/how-to-block-chatgpt-fro...
I like how Seattle has their own ordinance site; I don't know how other places do it, but the town I'm in uses eCode360