New top-level domains

Google’s new TLDs (top-level domains) like .app, .dev, and .page have built-in security features. They force you to serve everything through HTTPS, and these TLDs are included on the HSTS preload list without needing individual HSTS registration or configuration.

I moved over my one-page personal website to csaba.page. csabatechnology.github.io and csabaconsulting.github.io will redirect here. I also bought csaba.dev and csaba.app. Until they have individual content, they’ll redirect as well.

I experienced the security firsthand when I found a page whose SSL certificate had expired.

1. HSTS works: browsers didn’t allow adding any exceptions for the certificate anymore. So there’s no way to view the site with an evergreen browser (I tried Firefox and Chrome).
2. Domain privacy protection works as well. Google’s domain registrar and other registrars also offer privacy protection. This means that emails and addresses are redacted from the registrar listing and can only be accessed in a cumbersome way. I thought I would contact the webmaster of that site, but due to the privacy protection I was not able to find an email address—which is how it should be if the privacy protection is on.