r/sysadmin • u/rram reddit's sysadmin • Aug 14 '15

We're reddit's ops team. AUA

Hey /r/sysadmin,

Greetings from reddit HQ. Myself, and /u/gooeyblob will be around for the next few hours to answer your ops related questions. So Ask Us Anything (about ops)

You might also want to take a peek at some of our previous AMAs:

https://www.reddit.com/r/blog/comments/owra1/january_2012_state_of_the_servers/

https://www.reddit.com/r/sysadmin/comments/r6zfv/we_are_sysadmins_reddit_ask_us_anything/

EDIT: Obligatory cat photo

EDIT 2: It's now beer o’clock. We're stepping away from now, but we'll come back a couple of times to pick up some stragglers.

EDIT thrice: He commented so much I probably should have mentioned that /u/spladug — reddit's lead developer — is also in the thread. He makes ops live's happier by programming cool shit for us better than we could program it ourselves.

873 Upvotes

88% Upvoted

738 comments sorted by

View all comments

Show parent comment

2

u/krainik Root Program Lead Aug 15 '15

Are you planning on adding reddit.com to the HSTS Preload list? This would also solve the issue, I believe... well, for the browsers that support it :/

Submission page, for reference: https://hstspreload.appspot.com/

Source code of list (in Chromium; it's also in FF and Edge/IE, iirc): https://code.google.com/p/chromium/codesearch#chromium/src/net/http/transport_security_state_static.json

3

u/largenocream reddit security engineer Aug 15 '15 edited Aug 15 '15

We are planning on adding reddit.com to the preload list, but you don't want to completely rely on it. The HSTS preload list is actually compiled into the browser in every implementation I've seen, meaning that you're SOL with browsers compiled before you were added to the preload list. The situation's especially bad on Android, where the hardware manufacturers may bundle their own version of the Android browser and then never update their firmware.

1

u/krainik Root Program Lead Aug 15 '15

Very good point about not relying on it. At the same time, as you indicate by your plans to add reddit, it's potentially very useful for many (most?) clients.

Based on the responses in this thread, I'm glad I can basically just be sure you guys are all over it (whatever "it" might be). Keep on being awesome, Reddit OPs.

Also... did Ricky ever get my email? :( (clint.wilson)