On 09/01/2014 11:31 AM, Erik Romijn wrote: [snip] > So, although I encourage anyone to enable HSTS, we should not recommend > people to just "switch it on". They should be well aware of the > consequences as it can affect an unknown set of users beyond their > Django site, long after the change has been reverted. The possible > seriousness should be reflected in any encouragement we make for HSTS to > be enabled.
I very much agree with this concern. I think Tim has already added good warnings to the documentation for HSTS; in comments on the pull request I'm also advocating for adding at least a brief note to the warning message itself, along the lines of "you can break things badly if you enable this without reading the documentation first." Carl -- You received this message because you are subscribed to the Google Groups "Django developers" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at http://groups.google.com/group/django-developers. To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/540614C3.6040206%40oddbird.net. For more options, visit https://groups.google.com/d/optout.
