This is fantastic news! And they decided to include the Chromium HSTS Preload list too. I've submitted something like ~30 domains to the list, and having them covered in newer versions of IE automatically is a very nice thing.
A while. It takes a significant amount of effort to effect change in the IT infrastructure of every organization within the US government.
(konklone does mention this in their Reddit post in /r/netsec)
There's not a master plan, but there's several promising lines of work happening. Hopefully 2015 will be a fun year. Tomorrow, I'll be on Federal News Radio in the morning, preaching the gospel to DC commuters.
In terms of Curve25519: it seems so, yes. That is what CFRG's current draft recommends to the TLS Working Group for a 256-bit curve, along with the X25519 key exchange defined with it. There's a slot waiting in WebCrypto for it, too.
Not too sure about signatures yet: Ed25519 is definitely one contender, but I don't know where that'll end up.
Don't know why you are downvoted but that's true. Windows versions tend to be long-lasting. If Microsoft keeps tying browsers to them, then they will always have browsers that remain behind for 5+ years.
And of course the next IE12/"Spartan" will be tied to Windows 10...so this won't change anytime soon apparently.
It would be much better progress if they could use the latest IE on whatever version of windows, rather than being forced develop for the lowest common denominator.
Chrome has it right, it's always the latest version, and firefox is better than it used to be, but even then they didn't say "sorry, you need the latest windows to use this version, here, have this 4 year old version instead"
It's ridiculous, and I can't think of one valid technical reason for it
Probably that they have a different organization than the preloaded list you find elsewhere.
When you delete that HSTS.plist and restart your Safari, the same file will pop up again, containing the same entries (if you haven't modified it before). So it is reasonable to assume that the list is preloaded rather than gradually built up.
Are they really sure this feature is "exciting"? It's a welcome change for sure, but I can't quite see them beaming with joy or writhing orgasmically, simply due to an implementation of HSTS. An odd fetish, indeed.
Apparently it's becoming a thing to cheer for Microsoft when it implements a feature in its browser that others have had for years. It's like cheering for the 10th guy who crossed the finishing line instead of the first.
Firefox has had HSTS support since version 4 and Chrome has had it since 4.0.211.0. Indeed, it is great to see Microsoft do this, but too little too late?
