Hacker News Reader

Comment by CydeWeys | Hacker News Reader

Greater use of HSTS preloading is also a good way for legitimate sites to prevent being affected by any sort of privacy crackdowns on HSTS. Preloading at the TLD level is ideal.

View on HN

Preloading at the TLD level is pretty severe, will never be done for .com / .net / .org, and so will never apply to the vast majority of sites people visit. Interesting idea, but unrealistic.

Yes, it can't be done retroactively, but it can be done for new TLDs that haven't launched yet.

If I remember correctly, Google has done this with the `.dev` TLD they own, so we're already seeing some of it.

There are currently eight HSTS-preloaded TLDs with more on the way, including the first available for open registration coming soon.

Do you have a list of them? I'm especially interested in the TLD for open registration.

  .app
  .bank
  .chrome
  .dev
  .foo
  .google
  .insurance
  .page

Source: https://github.com/chromium/chromium/raw/master/net/http/tra... (grep for TLD)

See https://registry.google

Reply on news.ycombinator.com