News for hackers. Stuff that matters.
Re:Protecting Against HSTS Abuse by geofft on Saturday March 17, 2018 @12:04AM (#16605552)
HSTS also protects external URLs; an old link to http://news.ycombinator.com gets internally rewritten to https://news.ycombinator.com without making the cleartext request. So HSTS is a more general solution.

Probably there will come a time when attempting HTTPS first instead of HTTP for manually-typed URLs without a protocol is the right default, but that's just a subset of the problem.

Re:Protecting Against HSTS Abuse by Buge on Saturday March 17, 2018 @09:36PM (#16610063)
Couldn't dmm's proposal be used for links as well?