{"action":"created","issue":{"url":"https://api.github.com/repos/EFForg/https-everywhere/issues/7126","repository_url":"https://api.github.com/repos/EFForg/https-everywhere","labels_url":"https://api.github.com/repos/EFForg/https-everywhere/issues/7126/labels{/name}","comments_url":"https://api.github.com/repos/EFForg/https-everywhere/issues/7126/comments","events_url":"https://api.github.com/repos/EFForg/https-everywhere/issues/7126/events","html_url":"https://github.com/EFForg/https-everywhere/issues/7126","id":179097831,"number":7126,"title":"Discussion for guidelines on removing HSTS preload rulesets","user":{"login":"jeremyn","id":299895,"avatar_url":"https://avatars.githubusercontent.com/u/299895?v=3","gravatar_id":"","url":"https://api.github.com/users/jeremyn","html_url":"https://github.com/jeremyn","followers_url":"https://api.github.com/users/jeremyn/followers","following_url":"https://api.github.com/users/jeremyn/following{/other_user}","gists_url":"https://api.github.com/users/jeremyn/gists{/gist_id}","starred_url":"https://api.github.com/users/jeremyn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeremyn/subscriptions","organizations_url":"https://api.github.com/users/jeremyn/orgs","repos_url":"https://api.github.com/users/jeremyn/repos","events_url":"https://api.github.com/users/jeremyn/events{/privacy}","received_events_url":"https://api.github.com/users/jeremyn/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/EFForg/https-everywhere/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":15,"created_at":"2016-09-25T17:32:33Z","updated_at":"2016-09-26T15:05:40Z","closed_at":null,"body":"@gloomy-ghost has submitted several pull requests deleting rulesets that are in the HSTS preload lists: [Chromium](https://cs.chromium.org/chromium/src/net/http/transport_security_state_static.json), [Firefox](https://dxr.mozilla.org/mozilla-aurora/source/security/manager/ssl/nsSTSPreloadList.inc), [Tor](https://gitweb.torproject.org/tor-browser.git/tree/security/manager/ssl/nsSTSPreloadList.inc?h=tor-browser-45.4.0esr-6.5-1). ( @gloomy-ghost has helpfully included links to these rulesets in their pull requests.) @J0WI and I have separately handled these and it turns out we disagree on when a ruleset should be deleted. We have mainly discussed this in pull request #7081 , but I'll repeat the discussion below.\r\n\r\n@J0WI rejects rulesets for deletion if the `Strict-Transport-Security` header does not contain the `preload` header that is required in the [HSTS preload submission requirements](https://hstspreload.appspot.com/), even if the domain is in the preload lists. I assume that the `preload` header was in the lists when the domain was submitted to the lists and was later removed for whatever reason. This turns to be a common situation. My own opinion is that if the domain is in the preload lists and it has a `Strict-Transport-Security` header, then we can delete the ruleset even if `preload` is missing. @J0WI correctly points out that according to the submission requirements,\r\n\r\n> Chrome has not yet removed any domains from the preload list for failing to keep up the requirements after submission, but there are plans to do so in the future.\r\n\r\nI think it is too restrictive to not delete a ruleset in the preload lists just because it might be removed from the lists later.\r\n\r\nAnother problem that I found in pull request #7053 : https://wiki.openssl.org has a complete `Strict-Transport-Security:\"max-age=31536000; includeSubDomains; preload\"` header, but its redirect target https://wiki.openssl.org/index.php/Main_Page doesn't even have a `Strict-Transport-Security` header. Should we delete a ruleset if some of the responses have the header but some don't? If so, how many URLs do we have to check? What if only `preload` is missing?\r\n\r\nPinging @fuglede and @Hainish for their input."},"comment":{"url":"https://api.github.com/repos/EFForg/https-everywhere/issues/comments/249597384","html_url":"https://github.com/EFForg/https-everywhere/issues/7126#issuecomment-249597384","issue_url":"https://api.github.com/repos/EFForg/https-everywhere/issues/7126","id":249597384,"user":{"login":"jeremyn","id":299895,"avatar_url":"https://avatars.githubusercontent.com/u/299895?v=3","gravatar_id":"","url":"https://api.github.com/users/jeremyn","html_url":"https://github.com/jeremyn","followers_url":"https://api.github.com/users/jeremyn/followers","following_url":"https://api.github.com/users/jeremyn/following{/other_user}","gists_url":"https://api.github.com/users/jeremyn/gists{/gist_id}","starred_url":"https://api.github.com/users/jeremyn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeremyn/subscriptions","organizations_url":"https://api.github.com/users/jeremyn/orgs","repos_url":"https://api.github.com/users/jeremyn/repos","events_url":"https://api.github.com/users/jeremyn/events{/privacy}","received_events_url":"https://api.github.com/users/jeremyn/received_events","type":"User","site_admin":false},"created_at":"2016-09-26T15:05:40Z","updated_at":"2016-09-26T15:05:40Z","body":"For redirecting: once a site is HSTS preloaded, the HTTP version of the site becomes inaccessible, which I guess is why Google checks that HTTP redirects to HTTPS."}}
{"actor":{"display_login":"jeremyn"}}