News for hackers. Stuff that matters.

A comment on Netflix and Fill.

Re:Netflix and Fill by justinsaccount on Thursday August 11, 2016 @12:11PM (#12269411)
Weird..

  $ curl https://techblog.netflix.com/2016/08/netflix-and-fill.html -vv
  *   Trying 2607:f8b0:4002:c06::d6...
  * Connected to techblog.netflix.com (2607:f8b0:4002:c06::d6) port 443 (#0)
  * Server aborted the SSL handshake
  * Closing connection 0
  curl: (35) Server aborted the SSL handshake
Fails from at least the 3 locations I just tried across the country.. Google outage?
[ Parent | on HN ]
Re:Netflix and Fill by diggan on Thursday August 11, 2016 @12:34PM (#12269647)
This gets mentioned every time a blogpost from Netflix appears on HN. I've mentioned it too! https://news.ycombinator.com/item?id=12217900

According to kpcyrd, this is what happens: " I have the same issue, even though the link actually is http, my browser tries to open the https version, no matter what. It looks like https://netflix.com had hsts with includeSubdomains at one point in time which my browser has still cached. "

[ Parent | on HN ]
Re:Netflix and Fill by nathancahill on Thursday August 11, 2016 @01:13PM (#12269992)
Which is why you should only enable HSTS if you plan on supporting it permanently.
[ Parent | on HN ]
Re:Netflix and Fill by peterwwillis on Thursday August 11, 2016 @01:23PM (#12270065)
"But there's no reason to not use HTTPS! What could go wrong?"

But, you know... we have to secure our blog posts from MitM...

[ Parent | on HN ]
Re:Netflix and Fill by eterm on Thursday August 11, 2016 @04:12PM (#12271263)
No, you have to secure your blog posts because cookies against the top level domain can be in the request headers sent to the subdomain[1].

It's a bit bizarre you'd blame HTTPS, what is your alternative, don't use https?

[1] I say "can" because it depends on how the top level cookie is set, whether the browser respects the secure flag, and individual browser versions.

[ Parent | on HN ]
Re:Netflix and Fill by Thaxll on Thursday August 11, 2016 @12:14PM (#12269445)
Why do you use HTTPS? The link is HTTP, their blog doesn't support HTTPS.
[ Parent | on HN ]
Re:Netflix and Fill by justinsaccount on Thursday August 11, 2016 @12:17PM (#12269472)
Ah.. https everywhere seems to think it should support it.

Oddly have never had a problem with it until now.

[ Parent | on HN ]
Re:Netflix and Fill by vonmoltke on Thursday August 11, 2016 @12:16PM (#12269467)
Their blog is directing me to an HTTPS link when I go to "techblog.netflix.com". It does it even when I specify HTTP.
[ Parent | on HN ]
Re:Netflix and Fill by justinsaccount on Thursday August 11, 2016 @12:18PM (#12269482)
Do you have https everywhere installed too?
[ Parent | on HN ]
Re:Netflix and Fill by vonmoltke on Thursday August 11, 2016 @12:22PM (#12269520)
No. Firefox seems to be doing this on its own.
[ Parent | on HN ]
Re:Netflix and Fill by niftich on Thursday August 11, 2016 @12:32PM (#12269627)
If you're running NoScript, check its settings. See: https://news.ycombinator.com/item?id=12256270#12257702
[ Parent | on HN ]
Re:Netflix and Fill by vonmoltke on Thursday August 11, 2016 @12:35PM (#12269658)
That did it, thanks. I would not have expected NoScript to be doing things like that.
[ Parent | on HN ]