Hacker News Reader

I'd recommend starting out with a small max-age value so that any mistaken records will expire quickly. (Disclosure: I'm a co-editor of the HSTS RFC.)

View on HN

Yeah. I noticed that paypal.com has a max-age of 4 hours.

Maybe the first step to avoid issues is to enforce SSL which is easy on any webserver before going HSTS.

Is there any downside, when using SSL, in enabling perfect forward secrecy?

Make sure you're using an SSL library that support ECDHE cipher suites... the non EC suites are very slow.

Reply on news.ycombinator.com