Tom S [:evilpie] Assignee
	Description • 12 years ago

Some websites changed. We should probably do this for every release?

	Tom S [:evilpie] Assignee
	Comment 1 • 12 years ago

Also we need to cordinate with Persona/browserid. (https://github.com/mozilla/browserid/issues/2903) They are rolling out a changed on feb 13th.

	Dana Keeler (she/her) (use needinfo) (:keeler for reviews)
	Comment 2 • 12 years ago

So, there's bug 836097 on file for getting this done automatically. If we're getting near(er) the merge date and we're not done with that, we can do it by hand.

	Tom S [:evilpie] Assignee
	Comment 3 • 12 years ago

We are getting close! I also wrote a patch that changes the update script, so that we don't abort if we are redirecting to an uri that is also on the STS list.

	Tom S [:evilpie] Assignee
	Comment 4 • 12 years ago

Last week we discussed that change. Basically we could always allow redirects, because we still check for the STS header. I still think we should only do it for pages, which were explicitly put onto the list.

	Tom S [:evilpie] Assignee
	Comment 5 • 12 years ago

Updated list after applying the previous patch.

We still don't have persona.org, login.persona.org nor browserid!

	Dana Keeler (she/her) (use needinfo) (:keeler for reviews)
	Comment 6 • 12 years ago

Comment on attachment 715498 [details] [diff] [review]
Allow redirects to pages on the STS list

Review of attachment 715498 [details] [diff] [review]:
-----------------------------------------------------------------

I think we would need the changes to getHSTSPreloadList.js in this patch.

Also, I maintain my skepticism that putting foo.com on the list when we get [foo.com 301 redirect without sts header] -> [www.foo.com with sts header] is the right thing to do (that's the goal here, right?). Certainly, putting www.foo.com on the list would be reasonable, but since foo.com has told us nothing of its HSTS state, if we're going to follow the spec, we can't consider it an HSTS host.

Also also, this should be a separate bug.

	Tom S [:evilpie] Assignee
	Comment 7 • 12 years ago

I am fine with not making the change here. This is the updated list with the old script.

	Dana Keeler (she/her) (use needinfo) (:keeler for reviews)
	Comment 8 • 12 years ago

Comment on attachment 717334 [details] [diff] [review]
just the update

Review of attachment 717334 [details] [diff] [review]:
-----------------------------------------------------------------

I think the patch in bug 844527 will supersede this one, so I'm clearing the review for now.

	Tom S [:evilpie] Assignee
	Comment 9 • 12 years ago

I guess we can just dupe this now.