Hacker News Reader

Comment by etskinner | Hacker News Reader

http://example.com also does this, albeit without the promise of never switching

And with a different relationship:

* neverssl might be bought out, or re-registered, at some time in the future.

* example.com is a IANA reserved domain [0], which whilst it doesn't guarantee they'll never deploy SSL, does mean nobody else can register it, ever (RFC 6761) [1].

[0] https://www.iana.org/domains/reserved

[1] https://tools.ietf.org/html/rfc6761

Has an interesting WHOIS record too. The "registrar" is "RESERVED-Internet Assigned Numbers Authority", and no admin/technical/billing contacts like in standard whois entries.

http://example.com/ does deploy HTTPS https://example.com/ - but a redirect from http is unlikely, at least until the .com TLD is HSTS preloaded (and this might not be for another 10 years or so).

In both Chrome and Firefox, when I type "example.com" into the URL bar, I go to https://example.com , probably because I've visited the https site before and they remember that. So I do not recommend example.com .

Indeed, "browser.urlbar.autoFill" option (enabled by default) would do that in Firefox.

There should be no forced https redirection if you fill in http:// prefix by hand though. At least for now, until example.com adds HSTS headers.

I don't think the IANA domains make use of HSTS or anything of the like.

    HTTP/2.0 304 Not Modified
    cache-control: max-age=604800
    date: Sat, 02 Nov 2019 22:22:19 GMT
    etag: "3147526947+gzip"
    expires: Sat, 09 Nov 2019 22:22:19 GMT
    last-modified: Thu, 17 Oct 2019 07:18:26 GMT
    server: ECS (sjc/4E71)
    vary: Accept-Encoding

If you type "example.com" into the URL, both Firefox and Chrome will try HTTPS first. If you want plain HTTP, you just need to ask for it: "http://example.com"

I don't think HTTPS is the default automatically. When I create a new Chrome profile, then type example.com into the url bar and hit enter, I go to http://example.com . Then when I type https://example.com twice (each time hitting enter) then type example.com and hit enter, I go to https://example.com . So I think it might be whichever is more common in your history.

Firefox behaves very similarly, except I don't have to visit https://example.com twice before it becomes the default, I just have to visit it once.

This could also happen because of an extension like HTTPS Everywhere, which requests the https by default when both are available.

HTTPS Everywhere uses built-in rules, not heuristics, to determine when to rewrite an HTTP request to HTTPS. There does not appear to be a rule for example.com, so HTTPS Everywhere does not cause a rewrite.

It also sends the "Upgrade-Insecure-Request" header, which can cause that switch to take place.

For Firefox, this may occur when the address bar autocompletes from history, pulling the https:// entry. As far as I can tell, it doesn’t have anything to do with prioritizing HTTPS, just whichever is more frequent in your history (if you visit the HTTP enough times it will switch to picking that for autocomplete). If you don’t use the autocomplete entry (for example, by tab-completing it but deleting the trailing slash), then it will use HTTP unless you actually typed https://.

The Firefox instance I'm using at the moment goes to the non-TLS version when I type "example.com" in the address bar.

Another one: http://http.rip

This is very pedantic, but technically nothing requires an HTTP service to be hosted at example.com. It's only guaranteed to be reserved and never assigned to a real organization at the DNS level.

I think the only promise example.com has is that the domain will always exist.

I'm not sure that's even true. RFC 6761 says "IANA currently maintains a web server providing a web page explaining the purpose of example domains."

Saying "currently" implies it's not guaranteed to always be true. (Although it's more likely to stick around than a random domain registered by a hobbyist.)

"the domain will exist" does not mean "someone will run a web server there and respond to traffic", though.

Though I'm not exactly sure what it does mean. That it will have at least one DNS record?

I've always used terrible.com

It's just your standard parked domain. I typed it in when I was frustrated one time trying to log into a public wifi. It worked and I didn't even understand why back then.

Reply on news.ycombinator.com