Comment by ywain
1 day ago
The detailed terms of the bet include this:
> A 301 redirect from www.longbets.org/601 to a different URL containing that text would also fulfill those conditions.
I assume this would cover the HTTP->HTTPS redirect scenario.
I think the parent is referring to the possibility that one day, browsers might put up a blanket security warning for HTTP URLs instead of following redirects. Or they might try to be a little too clever with HTTPS upgrades.
In particular, the automatic upgrade feature in modern browsers is based on several heuristics rather than explicit configuration like HSTS, so there's always a bit of room for breakage there. For example, they don't even check if the server returns a 301 redirect, which can be problematic if the server wants to redirect to HTTPS on a different host/port or make some changes to the path.
> Or they might try to be a little too clever with HTTPS upgrades.
They're not going to get any cleverer than they are now. In October we'll finally be done with heuristics or central databses of https-first websites used by the various browsers or the half a dozen of headers that you must dance around to get the upgrade to work securely and reliably. They will just default to https first.
https://blog.google/security/https-by-defau/
Yes this is about Chrome, but all others will follow.
Personally, if I were interpreting the bet, and that browser behavior had been changed before the day of the bet, I'd interpret that as failure, because the browser didn't show an HTML page, it showed a warning dialogue.
And in any case, at some point after browsers start doing that, I will be unsurprised if some further conditions prevail that provide reason for web servers to stop listening on http at all.
Yeah that was a clever bit of foresight there.