Preload HSTS and pins for two more Google domains.

Preload HSTS and pins for two more Google domains.

developer.android.com and dl.google.com.

BUG=170913
TEST=developer.android.com and dl.google.com still work


Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=180587

[agl, 2013-01-18 19:08:38]

https://codereview.chromium.org/11938026/diff/1/net/base/transport_security_s...
File net/base/transport_security_state_static.json (right):

https://codereview.chromium.org/11938026/diff/1/net/base/transport_security_s...
net/base/transport_security_state_static.json:179: { "name":
"developer.android.com", "include_subdomains": true, "mode": "force-https",
"pins": "google" },
This breaks for me in HTTPS.

https://codereview.chromium.org/11938026/diff/1/net/base/transport_security_s...
net/base/transport_security_state_static.json:190: { "name": "dl.google.com",
"include_subdomains": true, "mode": "force-https", "pins": "google" },
Have you checked with jchacon@?

[palmer, 2013-02-01 00:38:26]

>
https://codereview.chromium.org/11938026/diff/1/net/base/transport_security_s...
> net/base/transport_security_state_static.json:179: { "name":
> "developer.android.com", "include_subdomains": true, "mode": "force-https",
> "pins": "google" },
> This breaks for me in HTTPS.

How? I am driving around the site and not having any fatal problems. Some pages
have http:// images, so I get the caution triangle, but no explosions seem to
happen.

>
https://codereview.chromium.org/11938026/diff/1/net/base/transport_security_s...
> net/base/transport_security_state_static.json:190: { "name": "dl.google.com",
> "include_subdomains": true, "mode": "force-https", "pins": "google" },
> Have you checked with jchacon@?

jchacon, any feelings about this? It'd really be nice to download software from
Google only via HTTPS. :) (Adding you to the bug, too.)

[palmer, 2013-02-01 00:41:13]

Oops, jchacon for real now.

>
https://codereview.chromium.org/11938026/diff/1/net/base/transport_security_s...
> > net/base/transport_security_state_static.json:190: { "name":
"dl.google.com",
> > "include_subdomains": true, "mode": "force-https", "pins": "google" },
> > Have you checked with jchacon@?
> 
> jchacon, any feelings about this? It'd really be nice to download software
from
> Google only via HTTPS. :) (Adding you to the bug, too.)

[jchacon_google.com, 2013-02-01 00:48:51]

HTTPS is fine (dl.google.com is SSL enabled).

James



On Thu, Jan 31, 2013 at 4:41 PM, <palmer@chromium.org> wrote:

> Oops, jchacon for real now.
>
>
> https://codereview.chromium.**org/11938026/diff/1/net/base/**
>
transport_security_state_**static.json#newcode190<https://codereview.chromium.org/11938026/diff/1/net/base/transport_security_state_static.json#newcode190>
>
>> > net/base/transport_security_**state_static.json:190: { "name":
>>
> "dl.google.com",
>
>> > "include_subdomains": true, "mode": "force-https", "pins": "google" },
>> > Have you checked with jchacon@?
>>
>
>  jchacon, any feelings about this? It'd really be nice to download software
>>
> from
>
>> Google only via HTTPS. :) (Adding you to the bug, too.)
>>
>
>
>
>
https://codereview.chromium.**org/11938026/<https://codereview.chromium.org/1...
>

[palmer, 2013-02-01 01:32:44]

> HTTPS is fine (http://dl.google.com is SSL enabled).

Thanks James. Are you concerned about increased load or anything? This CL will
cause Chrome to start always requesting everything from dl.google.com via HTTPS.
I hope you're cool with that. :) It will help our users get our software/other
downloads in a trustworthy manner.

[palmer, 2013-02-01 19:23:17]

Thanks James! Anyone up for an Ell Gee Tee Em? If anyone can reproduce problems
with developer.android.com, I can remove it from this CL and we can work on it
later. But I'd really like to get dl. HSTS'd soon. Thanks!

[agl, 2013-02-01 19:27:28]

On 2013/02/01 19:23:17, Chris P. wrote:
> Thanks James! Anyone up for an Ell Gee Tee Em? If anyone can reproduce
problems
> with http://developer.android.com, I can remove it from this CL and we can
work on it
> later. But I'd really like to get dl. HSTS'd soon. Thanks!

dl LGTM.

developer.android.com is still littered with mixed-content for me. That doesn't
look great and suggests that the webmasters aren't testing in HTTPS mode which
is setting ourselves up for something worse (like blocked CSS).

[commit-bot: I haz the power, 2013-02-01 19:57:45]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/palmer@chromium.org/11938026/9001

[commit-bot: I haz the power, 2013-02-01 23:56:29]

Retried try job too often on win_rel for step(s) browser_tests
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=win_rel&nu...

[commit-bot: I haz the power, 2013-02-02 00:41:29]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/palmer@chromium.org/11938026/9001

[commit-bot: I haz the power, 2013-02-02 06:05:17]

Retried try job too often on win_rel for step(s) browser_tests
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=win_rel&nu...

[commit-bot: I haz the power, 2013-02-04 23:15:56]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/palmer@chromium.org/11938026/9001

[commit-bot: I haz the power, 2013-02-05 00:48:57]

Change committed as 180587