Require HTTPS for crbug.com.

net/http/transport_security_state_static.json

Index: net/http/transport_security_state_static.json
diff --git a/net/http/transport_security_state_static.json b/net/http/transport_security_state_static.json
index 2708797a60f7fc13502f8bb8ef3f75d858b315eb..aa65df597fd1eb76c69e097bbec5e55e4603259b 100644
--- a/net/http/transport_security_state_static.json
+++ b/net/http/transport_security_state_static.json
@@ -775,6 +775,7 @@
     { "name": "mobile.usaa.com", "mode": "force-https" },
     { "name": "subrosa.io", "include_subdomains": true, "mode": "force-https" },
     { "name": "detectify.com", "mode": "force-https" },
+    { "name": "crbug.com", "include_subdomains": true, "mode": "force-https" },

[Peter Kasting, 2014/05/28 18:57:23]

Shouldn't this go in the "Other Google-related domains that must use HTTPS"
section like codereview.chromium.org does?

Also, is there any chance we can alphabetize the entries in these lists, or
something?  The current ordering (or lack thereof) seems like a problem.

[engedy, 2014/05/28 20:57:57]

The domains in the two Google-related groups all have pinned certs, this one
cannot, therefore Adam preferred to have this down here.

I agree that we should alphabetize this.
 
On 2014/05/28 18:57:23, Peter Kasting wrote:

 
     // Entries that are only valid if the client supports SNI.
     { "name": "gmail.com", "mode": "force-https", "pins": "google", "snionly": true },