It seems silly that Chromium and Firefox now have separate HSTS lists (though Firefox's was seeded using the Chromium list [1]).
At the moment, these lists appear to be b) tied to specific browsers 2) tied to specific releases of those browsers.
Would it be viable to run some kind of global open registry where any website can be registered for mandatory HSTS? That way, every individual website owner doesn't need to submit a bug to Chromium and Mozilla - the browser just needs to securely connect to the registry and download the latest list. Or maybe DNSSEC can help ...
Maybe work on this is already underway, but I was reading some MLs a few weeks ago and I didn't see any forthcoming solutions ...
I believe that Firefox is still generating its HSTS preload list from Chromium's - a few months ago I got a site added to Chromium's HSTS list and a few weeks later it showed up in Firefox. I couldn't even figure out how to submit directly to Firefox.
I agree that a global registry would be better, but it should probably be updated using the browser's normal update channel, to avoid re-inventing the wheel. (And DNSSEC has way too many issues.) It's true that ties the list to specific releases, but since browsers have good, and frequent, auto-updating, I think that's OK.
Comments
It seems silly that Chromium and Firefox now have separate HSTS lists (though Firefox's was seeded using the Chromium list [1]).
At the moment, these lists appear to be b) tied to specific browsers 2) tied to specific releases of those browsers.
Would it be viable to run some kind of global open registry where any website can be registered for mandatory HSTS? That way, every individual website owner doesn't need to submit a bug to Chromium and Mozilla - the browser just needs to securely connect to the registry and download the latest list. Or maybe DNSSEC can help ...
Maybe work on this is already underway, but I was reading some MLs a few weeks ago and I didn't see any forthcoming solutions ...
1. https://blog.mozilla.org/security/2012/11/01/preloading-hsts...
I believe that Firefox is still generating its HSTS preload list from Chromium's - a few months ago I got a site added to Chromium's HSTS list and a few weeks later it showed up in Firefox. I couldn't even figure out how to submit directly to Firefox.
I agree that a global registry would be better, but it should probably be updated using the browser's normal update channel, to avoid re-inventing the wheel. (And DNSSEC has way too many issues.) It's true that ties the list to specific releases, but since browsers have good, and frequent, auto-updating, I think that's OK.
Every weekend the list from Chrome is used to automatically update Firefox in tree version.