Re: httpd: hsts (rfc 6797)

2015-07-20 Thread sid77
- Original Message - There is a non-standard preload token that Google requires to get onto Chrome's HSTS preload list[0] which is also used by Firefox. Any chance of supporting this? Or is its omission a conscious decision? [0] https://hstspreload.appspot.com/ FWIW, from my

Re: httpd: hsts (rfc 6797)

2015-07-18 Thread Kevin Chadwick
On Sat, 18 Jul 2015 02:53:01 +0200 Reyk Floeter wrote: HSTS is a good thing and widely pushed, eg. by Google, in an effort to enforce HTTPS over HTTP. It is a useful security option I agree HSTS is useful but disagree with the rhetoric personally. It improves security for average website

Re: httpd: hsts (rfc 6797)

2015-07-17 Thread Reyk Floeter
On Sat, Jul 18, 2015 at 12:14:37AM +, Florian Obser wrote: OK? As discussed, I like the implementation this way. Comments below. Reyk diff --git httpd.conf.5 httpd.conf.5 index b3eaad8..bfca29f 100644 --- httpd.conf.5 +++ httpd.conf.5 @@ -262,6 +262,18 @@ root directory of .Xr

Re: httpd: hsts (rfc 6797)

2015-07-17 Thread Ted Unangst
Reyk Floeter wrote: On Fri, Jul 17, 2015 at 08:20:11PM -0400, Ted Unangst wrote: Florian Obser wrote: OK? diff --git httpd.conf.5 httpd.conf.5 index b3eaad8..bfca29f 100644 --- httpd.conf.5 +++ httpd.conf.5 @@ -262,6 +262,18 @@ root directory of .Xr httpd 8 and

Re: httpd: hsts (rfc 6797)

2015-07-17 Thread Ted Unangst
Florian Obser wrote: OK? diff --git httpd.conf.5 httpd.conf.5 index b3eaad8..bfca29f 100644 --- httpd.conf.5 +++ httpd.conf.5 @@ -262,6 +262,18 @@ root directory of .Xr httpd 8 and defaults to .Pa /run/slowcgi.sock . +.It Ic hsts Oo Ar option Oc +Enable HTTP Strict Transport

httpd: hsts (rfc 6797)

2015-07-17 Thread Florian Obser
OK? diff --git httpd.conf.5 httpd.conf.5 index b3eaad8..bfca29f 100644 --- httpd.conf.5 +++ httpd.conf.5 @@ -262,6 +262,18 @@ root directory of .Xr httpd 8 and defaults to .Pa /run/slowcgi.sock . +.It Ic hsts Oo Ar option Oc +Enable HTTP Strict Transport Security. +Valid options are: +.Bl -tag

Re: httpd: hsts (rfc 6797)

2015-07-17 Thread Carlin Bingham
On Sat, 18 Jul 2015, at 12:14 PM, Florian Obser wrote: OK? diff --git httpd.conf.5 httpd.conf.5 index b3eaad8..bfca29f 100644 --- httpd.conf.5 +++ httpd.conf.5 @@ -262,6 +262,18 @@ root directory of .Xr httpd 8 and defaults to .Pa /run/slowcgi.sock . +.It Ic hsts Oo Ar option Oc

Re: httpd: hsts (rfc 6797)

2015-07-17 Thread Reyk Floeter
On Fri, Jul 17, 2015 at 08:51:54PM -0400, Ted Unangst wrote: Reyk Floeter wrote: On Fri, Jul 17, 2015 at 08:20:11PM -0400, Ted Unangst wrote: Florian Obser wrote: OK? diff --git httpd.conf.5 httpd.conf.5 index b3eaad8..bfca29f 100644 --- httpd.conf.5 +++ httpd.conf.5

Re: httpd: hsts (rfc 6797)

2015-07-17 Thread Reyk Floeter
On Fri, Jul 17, 2015 at 08:20:11PM -0400, Ted Unangst wrote: Florian Obser wrote: OK? diff --git httpd.conf.5 httpd.conf.5 index b3eaad8..bfca29f 100644 --- httpd.conf.5 +++ httpd.conf.5 @@ -262,6 +262,18 @@ root directory of .Xr httpd 8 and defaults to .Pa

Re: httpd: hsts (rfc 6797)

2015-07-17 Thread Stuart Henderson
On 2015/07/17 20:51, Ted Unangst wrote: Reyk Floeter wrote: On Fri, Jul 17, 2015 at 08:20:11PM -0400, Ted Unangst wrote: Florian Obser wrote: OK? diff --git httpd.conf.5 httpd.conf.5 index b3eaad8..bfca29f 100644 --- httpd.conf.5 +++ httpd.conf.5 @@ -262,6