Introducing .app, a more secure home for apps on the web

Post by hk__2 » Tue, May 01, 2018, 7:11 PM UTC

vthallam wrote: post #44

CydeWeys wrote: post #19

Earlier quoted context omitted.

Tech lead of Google Registry here. I can help answer some questions. HSTS preloading offers the highest possible level of security, as the user's browser is enforcing the use of HTTPS. Merely serving via HTTPS is only optional security, as any man-in-the-middle attacker can strip that encryption (see sslstrip, released six years ago). For more information see my blog post from last year: https://security.googleblog.c…

I know TLD's doesn't affect SEO, but does Google enhance .app domain SEO when people search for apps on Google search?

Post by ucaetano » Tue, May 01, 2018, 7:13 PM UTC

patrickg_zill wrote: post #130

Is being cynical about this allowed? Google throws down a few hundred grand to get the .app domain, in concert with modifying their web browser to deliberately mark others' traffic as "Insecure" (it is not necessarily!), and reaps the fees now and in perpetuity ever year thereafter for maintaining a simple database of DNS glue entries which you literally could maintain using MS Access (by which I mean, the database s…

Post by prophesi » Tue, May 01, 2018, 7:14 PM UTC

patrickg_zill wrote: post #130

Is being cynical about this allowed? Google throws down a few hundred grand to get the .app domain, in concert with modifying their web browser to deliberately mark others' traffic as "Insecure" (it is not necessarily!), and reaps the fees now and in perpetuity ever year thereafter for maintaining a simple database of DNS glue entries which you literally could maintain using MS Access (by which I mean, the database s…

Post by cpeterso » Tue, May 01, 2018, 7:15 PM UTC

chatmasta wrote: post #124

andybak wrote: post #114

Earlier quoted context omitted.

Can you provide an example? Something more specific than merely competing with existing businesses. The intent is key in the original definition of EEE.

I was thinking primarily of Google AMP when I wrote that. Google's strategy is not necessarily the same as Microsoft's was; often it's a bit more subtle, but the common theme is that Google pushes standards that are primarily beneficial to itself, but often paints them disingenuously as "helping the web" or some equally meaningless BS. Some examples which might not qualify specifically as EEE, but certainly qualify a…

Post by hk__2 » Tue, May 01, 2018, 7:15 PM UTC

guessmyname wrote: post #84

Here is a small script for the Terminal lovers. #!/bin/bash DOMAIN="${1:-google}" RESPONSE=$( curl -XGET -s \ -H "Accept-Language: en-us" \ -H "Accept: */*" \ -H "Connection: keep-alive" \ -H "Host: domain-registry.appspot.com" \ -H "Origin: https://get.app" \ -H "Referer: https://get.app/" \ -H "User-Agent: Mozilla/5.0 (KHTML, like Gecko) Safari/537.36" \ "https://domain-registry.appspot.com/check?domain=${DOMAIN}.a…

    $ curl -sL https://domain-registry.appspot.com/check?domain=$DOMAIN.app
    {"status":"success","available":true,"tier":"standard"}