Skip to content
This repository has been archived by the owner on Nov 6, 2023. It is now read-only.

Removing hsts-preloaded targets and rulesets (via hsts-prune utility) #9891

Merged
merged 1 commit into from
May 12, 2017

Conversation

Hainish
Copy link
Member

@Hainish Hainish commented May 12, 2017

No description provided.

@Bisaloo
Copy link
Collaborator

Bisaloo commented May 13, 2017

Great! Thank you!

However, I had noticed domains that have been preloaded but they weren't removed. For example:

and some others I lost on the way.

Any idea why?

@Hainish
Copy link
Member Author

Hainish commented May 15, 2017

@Bisaloo this may be for various reasons. One is that they aren't preloaded on all the browsers that we support. Another possible reason is that they aren't delivering the "preload" directive in the Strict-Transport-Security header - this makes these preloads prone to removal in future iterations of the list, so we don't want to remove them from HTTPS Everywhere and leave them unprotected.

@Hainish
Copy link
Member Author

Hainish commented May 15, 2017

Checking now, the absence of the preload directive seems to be the case for all three of those above.

@Hainish
Copy link
Member Author

Hainish commented May 15, 2017

I've just talked with the Tor Project web admins, they've added the preload directive back to torproject.org and associated subdomains.

@Bisaloo
Copy link
Collaborator

Bisaloo commented Jul 16, 2017

@Hainish, the preload directive is indeed back but they also need to add the includeSubDomains directive.

@Hainish
Copy link
Member Author

Hainish commented Jul 18, 2017

@Bisaloo I've talked with them about this and they are unwilling to do so. I'm unsure why.

@Hainish Hainish deleted the hsts-prune branch February 23, 2018 01:53
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants