Herzenpfoten 🩷🐾

At a certain point I made the transition from #Apache to #Nginx and now I'm thinking of transitioning to #Caddy. I like that the configuration file is really small and it fetches certificates for HTTPS without me doing a damn thing.

#Chromium / #Chrome just started shipping experimental builds with #HTTPSonly mode enabled by default and has plans to ship it to everyone once it's mature, and I hope #Firefox will do this as well. So I can even stop caring about port 80 entirely once that happens, as the major browsers would no longer default to trying port 80 first.

Aug 20, 2023 at 4:04pmWeb
Show threadHerzenpfoten 🩷🐾Aug 20, 2023

On this matter, the source article for the experimental builds for #HTTPSonly mode by default is here: https://blog.chromium.org/2023/08/towards-https-by-default.html

It's interesting to note that the HTTPS-only mode that #Chrome / #Chromium will provide actually comprises of three main features, one of which is already the default:

  • if no protocol like https:// or http:// is typed, default to HTTPS (since 2021)
  • HTTPS Upgrades -> if you click on an HTTP page, redirect to HTTPS (if the page exists)
  • HTTPS First -> try HTTPS first, show "this page is insecure" message as fallback to go back to HTTP (kinda like HSTS)

(and the insecure downloads thingie, which IMO is pretty minor)

Meanwhile the HTTPS-only mode that #Firefox already ships as a setting and is already enabled by default in Private Tabs has these three features bundled together.

Towards HTTPS by default

For the past several years, more than 90% of Chrome users' navigations have been to HTTPS sites, across all major platforms. Thankfully, th...

Chromium Blog