News for hackers. Stuff that matters.
Re:Protecting Against HSTS Abuse by RyanZAG on Saturday March 17, 2018 @04:50AM (#16606089)
Trying HTTPS first would still help a lot in other cases, such as the one in the article. None of the super cookie HSTS techniques would have worked in the first place if the browser had just always tried to use HTTPS first.

Probably other unknown vulnerabilities could be averted by just trying HTTPS first too. Not doing so should be considered bad practice, with or without HSTS.

Re:Protecting Against HSTS Abuse by _Codemonkeyism on Saturday March 17, 2018 @07:00AM (#16606400)
Especially there is no reason, if I type news.ycombinator.com in my address bar to expand with http:// instead of https://