https://qubes-os.org redirects to an insecure page: http://www.qubes-os.org/ (and potentially enabling HSTS?)

[ghost]

https://qubes-os.org redirects to an insecure page: http://www.qubes-os.org/. http://qubes-os.org should immediately redirect to https://qubes-os.org (and then to https://www.qubes-os.org) Take a look at: https://hstspreload.org/?domain=qubes-os.org

By solving the issues above the Qubes-os.org website will get added to the HSTS Preload list (which is used by the main web browsers, Chrome, Firefox, ...) to force HTTPS.

[andrewdavidwong]

@marmarek, can you control this via Cloudflare's settings?

[andrewdavidwong]

@marmarek, can you control this via Cloudflare's settings?

[andrewdavidwong]

Also worth noting:

• https://www.qubes-os.org/doc/user-faq/#should-i-trust-this-website
• https://www.qubes-os.org/doc/user-faq/#why-doesnt-this-website-have-security-feature-x

[andrewdavidwong]

Also worth noting:

• https://www.qubes-os.org/doc/user-faq/#should-i-trust-this-website
• https://www.qubes-os.org/doc/user-faq/#why-doesnt-this-website-have-security-feature-x

[marmarek]

I've added http://qubes-os.org/ -> https://qubes-os.org/ redirect in CF, but now github pages redirect https://qubes-os.org/ -> http://www.qubes-os.org/ ...
Ok, added the second redirect also at CF level. Now the only issue reported by hsts preload is missing includeSubDomains. But for this we need to be sure that really all subdomains use HTTPS.

[marmarek]

I've added http://qubes-os.org/ -> https://qubes-os.org/ redirect in CF, but now github pages redirect https://qubes-os.org/ -> http://www.qubes-os.org/ ...
Ok, added the second redirect also at CF level. Now the only issue reported by hsts preload is missing includeSubDomains. But for this we need to be sure that really all subdomains use HTTPS.

[andrewdavidwong]

But for this we need to be sure that really all subdomains use HTTPS.

The ones that I'm aware of appear to, but I don't have access to an exhaustive list.

[andrewdavidwong]

But for this we need to be sure that really all subdomains use HTTPS.

The ones that I'm aware of appear to, but I don't have access to an exhaustive list.

[marmarek]

The list isn't that long. Looks like all of them do support https. But not all have redirects http->https. I guess it's irrelevant here (for HSTS preload)?
I'm wondering about yum.qubes-os.org and deb.qubes-os.org. AFAIR there were some problems with https and APT repositories. Does APT (or any non-browser http client) care about HSTS?

[marmarek]

The list isn't that long. Looks like all of them do support https. But not all have redirects http->https. I guess it's irrelevant here (for HSTS preload)?
I'm wondering about yum.qubes-os.org and deb.qubes-os.org. AFAIR there were some problems with https and APT repositories. Does APT (or any non-browser http client) care about HSTS?

[andrewdavidwong]

No idea. Maybe @adrelanos knows?

[andrewdavidwong]

No idea. Maybe @adrelanos knows?

[adrelanos]

Does APT care about HSTS?

No, and I haven't found any discussions about having apt-get do that either. Looks like HSTS makes limited sense for apt-get? Either you add some https or http repositories. If it's https, it should really be used. And if it's http, it should not automagically upgrade to https. I guess?

[adrelanos]

Does APT care about HSTS?

No, and I haven't found any discussions about having apt-get do that either. Looks like HSTS makes limited sense for apt-get? Either you add some https or http repositories. If it's https, it should really be used. And if it's http, it should not automagically upgrade to https. I guess?

[marmarek]

Ok, enabled includeSubDomains. Lets hope I didn't missed anything...

[marmarek]

Ok, enabled includeSubDomains. Lets hope I didn't missed anything...

[ghost]

@marmarek @andrewdavidwong This has been implemented https://hstspreload.org/?domain=qubes-os.org

Please close the issue.

[ghost]

@marmarek @andrewdavidwong This has been implemented https://hstspreload.org/?domain=qubes-os.org

Please close the issue.