Add Yahoo domains to HSTS preload list.

Add Yahoo domains to HSTS preload list.

By request.

R=agl@chromium.org

Committed: https://chromium.googlesource.com/chromium/src/+/1bf7c6397be697e964bc02b44d5e806af2e77d9c

[palmer, 2014-10-02 19:02:32]

palmer@chromium.org changed reviewers:
+ agl@chromium.org, rsleevi@chromium.org

[palmer, 2014-10-02 19:02:32]

PTAL.

[agl, 2014-10-02 19:10:49]

Why is include_subdomains false? It should always be true unless there's a good
reason otherwise. (Even if there aren't any subdomains.)

If there's a good reason for some of the cases, include_subdomains should just
be omitted in order to make them false.

[palmer, 2014-10-06 19:34:17]

> Why is include_subdomains false? It should always be true unless there's a
good
> reason otherwise. (Even if there aren't any subdomains.)

I consulted with Yahoo, and they said to set include_subdomains to true. So, did
that.

[agl, 2014-10-07 20:52:04]

lgtm

[Scott Beardsley, 2014-10-07 21:46:45]

On 2014/10/06 19:34:17, Chromium Palmer wrote:
> > Why is include_subdomains false? It should always be true unless there's a
> good
> > reason otherwise. (Even if there aren't any subdomains.)
> 
> I consulted with Yahoo, and they said to set include_subdomains to true. So,
did
> that.

Actually, there are legacy subdomains of search.yahoo.com which do not support
HTTPS currently and won't for the foreseeable future. We should probably keep
the include_subdomains for search.yahoo.com (and it's subdomains) set to false.

Here is an example:

sugg.us.search.yahoo.com

[palmer, 2014-10-07 23:05:49]

> Actually, there are legacy subdomains of http://search.yahoo.com which do not
support
> HTTPS currently and won't for the foreseeable future. We should probably keep
> the include_subdomains for http://search.yahoo.com (and it's subdomains) set
to false.

OK, I set it back to false.

[Scott Beardsley, 2014-10-08 08:12:15]

On 2014/10/07 23:05:49, Chromium Palmer wrote:

> OK, I set it back to false.

Thanks! The search sub-domains look fine. I think the edit/login/mail stuff
might be able to be set to true, I'll check with someone later... today

[Scott Beardsley, 2014-10-08 21:14:24]

On 2014/10/08 08:12:15, Scott Beardsley wrote:
> On 2014/10/07 23:05:49, Chromium Palmer wrote:
> 
> > OK, I set it back to false.
> 
> Thanks! The search sub-domains look fine. I think the edit/login/mail stuff
> might be able to be set to true, I'll check with someone later... today

I just confirmed the following with the respective Yahoo teams:

mail.yahoo.com : include_subdomains = false
login.yahoo.com : include_subdomains = true
edit.yahoo.com : include_subdomains = true

[commit-bot: I haz the power, 2014-10-13 20:21:00]

Patchset 5 (id:??) landed as
https://crrev.com/1bf7c6397be697e964bc02b44d5e806af2e77d9c
Cr-Commit-Position: refs/heads/master@{#299354}

[palmer, 2014-10-13 20:21:03]

Committed patchset #5 (id:80001) manually as
1bf7c6397be697e964bc02b44d5e806af2e77d9c (presubmit successful).