Hacker News Reader

Comment by ButlerianJihad | Hacker News Reader

Same here! Yes, I used it as the well-known site that supported unencrypted http and no HSTS. Yes, I was one of those guys using the site "as a service" rather than simply documentation. Admittedly, it was perhaps interchangeable with other sites, but since it reliably worked for that purpose, I couldn't be arsed to find other ones.

Isn't there a dedicated site called nohttps or something? NeverSSL? I just tried http NeverSSL, and it redirected me to an https page with a random hostname and an Amazon SSL certificate!

Does example.com still function this way, with http and no HSTS? I noticed that my Chrome browser was immediately redirected in the customary way.

View on HN

http://neverssl.com/online/ seems to work for me?

Are you perhaps on an untrusted network which is spoofing that url to make it redirect somewhere else?

No, NeverSSL changed to have SSL a while back - around the time that Chrome/Firefox started throwing big warning signs and/or blocking non-https pages.

Wait, are you saying neverssl.com now sometimes uses SSL?

If this is a joke, it's over my head. If not, I'm not knowledgeable enough in this space to pass judgement, but that would seem crazy to me. Like the owner should consider a domain name change :)

It has SSL on the main domain, and some subdomains without SSL (wildcard perhaps?). The main domain (when accessed over SSL?) redirects to a subdomain with plain HTTP.

Kinda weird setup!

Edit: okay, the subdomains also have SSL. I guess the random subdomain thing is to make sure it hasn’t been cached in a “this site has HTTPS” list. The HTTPS is needed, of course, to please the browser makers, as the parent says.

My browser (iOS safari) just takes me to the ssl version from that link, so “never ssl” seems wrong?

http://example.com/ works for me in Safari, warning that the site is “not secure”, but only if I type it in by hand.

http://http.rip/ is one I use

Wow finally, a "no ssl" site that actually doesn't use SSL! I was so disappointed when "NEVERssl" added SSL, like you literally have ONE job. Some clients automatically upgrade http->https or prepend https if left unspecified, so it's nice to have an explicitly HTTP-only (IE port 80-only) service for testing/captive portals.

This is very useful, thanks for sharing!

Reply on news.ycombinator.com