Update from chromium https://crrev.com/304586

net/http/transport_security_state_static.json

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file contains the HSTS preloaded list in a machine readable format.
 
 // The top-level element is a dictionary with two keys: "pinsets" maps details
 // of certificate pinning to a name and "entries" contains the HSTS details for
 // each host.
 //
@@ skipping 168 matching lines @@
       ]
     },
     {
       "name": "facebook",
       "static_spki_hashes": [
         "SymantecClass3EVG3",
         "DigiCertECCSecureServerCA",
         "DigiCertEVRoot",
         "FacebookBackup"
       ]
+    },
+    {
+      "name": "spideroak",
+      "static_spki_hashes": [
+        "RapidSSL",
+        "SpiderOak1",
+        "SpiderOak2"
+      ]
     }
   ],
 
   "entries": [
     // Dummy entry to test certificate pinning.
     { "name": "pinningtest.appspot.com", "include_subdomains": true, "pins": "test" },
 
     // (*.)google.com, iff using SSL, must use an acceptable certificate.
     { "name": "google.com", "include_subdomains": true, "pins": "google" },
 
@@ skipping 1060 matching lines @@
     { "name": "knowledgehook.com", "include_subdomains": true, "mode": "force-https" },
     { "name": "lodash.com", "include_subdomains": true, "mode": "force-https" },
     { "name": "md5file.com", "include_subdomains": true, "mode": "force-https" },
     { "name": "omitech.co.uk", "include_subdomains": true, "mode": "force-https" },
     { "name": "orbograph-hrcm.com", "include_subdomains": true, "mode": "force-https" },
     { "name": "password.codes", "include_subdomains": true, "mode": "force-https" },
     { "name": "prakharprasad.com", "include_subdomains": true, "mode": "force-https" },
     { "name": "ravchat.com", "include_subdomains": true, "mode": "force-https" },
     { "name": "sciencex.com", "include_subdomains": true, "mode": "force-https" },
     { "name": "shiinko.com", "include_subdomains": true, "mode": "force-https" },
-    { "name": "spideroak.com", "include_subdomains": true, "mode": "force-https" },
+    { "name": "spideroak.com", "include_subdomains": true, "mode": "force-https", "pins": "spideroak" },
     { "name": "thorncreek.net", "include_subdomains": true, "mode": "force-https" },
     { "name": "tno.io", "include_subdomains": true, "mode": "force-https" },
     { "name": "translatoruk.co.uk", "include_subdomains": true, "mode": "force-https" },
     { "name": "wepay.in.th", "include_subdomains": true, "mode": "force-https" },
     { "name": "zixiao.wang", "include_subdomains": true, "mode": "force-https" },
 
     { "name": "at.search.yahoo.com", "include_subdomains": false, "mode": "force-https" },
     { "name": "au.search.yahoo.com", "include_subdomains": false, "mode": "force-https" },
     { "name": "az.search.yahoo.com", "include_subdomains": false, "mode": "force-https" },
     { "name": "be.search.yahoo.com", "include_subdomains": false, "mode": "force-https" },
@@ skipping 106 matching lines @@
     { "name": "segu-info.com.ar", "include_subdomains": true, "mode": "force-https" },
     { "name": "slattery.co", "include_subdomains": true, "mode": "force-https" },
     { "name": "slidebatch.com", "include_subdomains": true, "mode": "force-https" },
     { "name": "smartship.co.jp", "include_subdomains": true, "mode": "force-https" },
     { "name": "southside-crew.com", "include_subdomains": true, "mode": "force-https" },
     { "name": "tickopa.co.uk", "include_subdomains": true, "mode": "force-https" },
     { "name": "wieninternational.at", "include_subdomains": true, "mode": "force-https" },
     { "name": "fleximus.org", "include_subdomains": true, "mode": "force-https" },
 
     // Facebook would like to have pinning enforced on (*.)facebook.com and
-    // HSTS enforced on specific names. We can't (yet) represent that in JSON
-    // So we're currently only applying pinning on the specific names.
-    { "name": "facebook.com", "mode": "force-https", "pins": "facebook", "include_subdomains_for_pinning": true },
+    // HSTS enforced on specific names. We have the
+    // "include_subdomains_for_pinning" flag that can do that, but it triggered a
+    // wave of pinning failures and so isn't used until that can be investigated.
+    { "name": "facebook.com", "mode": "force-https", "pins": "facebook" },
     { "name": "www.facebook.com", "include_subdomains": true, "mode": "force-https", "pins": "facebook" },
     { "name": "m.facebook.com", "include_subdomains": true, "mode": "force-https", "pins": "facebook" },
     { "name": "tablet.facebook.com", "include_subdomains": true, "mode": "force-https", "pins": "facebook" },
     { "name": "secure.facebook.com", "include_subdomains": true, "mode": "force-https", "pins": "facebook" },
     { "name": "pixel.facebook.com", "include_subdomains": true, "mode": "force-https", "pins": "facebook" },
     { "name": "apps.facebook.com", "include_subdomains": true, "mode": "force-https", "pins": "facebook" },
     { "name": "upload.facebook.com", "include_subdomains": true, "mode": "force-https", "pins": "facebook" },
     { "name": "developers.facebook.com", "include_subdomains": true, "mode": "force-https", "pins": "facebook" },
     { "name": "touch.facebook.com", "include_subdomains": true, "mode": "force-https", "pins": "facebook" },
     { "name": "mbasic.facebook.com", "include_subdomains": true, "mode": "force-https", "pins": "facebook" },
@@ skipping 361 matching lines @@
     "GOOGLE_VU",
     "GOOGLE_WS",
     "CHROMIUM_ORG",
     "CRYPTO_CAT",
     "LAVABIT_COM",
     "GOOGLETAGMANAGER_COM",
     "GOOGLETAGSERVICES_COM",
     "DROPBOX_COM",
     "YOUTUBE_NOCOOKIE_COM",
     "2MDN_NET",
-    "FACEBOOK_COM"
+    "FACEBOOK_COM",
+    "SPIDEROAK_COM"
   ]
 }