Rustup: http://www.rustup.rs/ should 301 redirect to https://www.rustup.rs/ with the HSTS header.

[brson]

I must have set up the redirect incorrectly because it's not doing it.

[sourcefrog]

Aside from the redirect, https://rustup.rs/ does not seem to serve a Strict-Transport-Security header.

It looks like there's an S3 limitation there: https://serverfault.com/q/820939/44697.

[Darkspirit]

curl https://sh.rustup.rs -sSf | sh

• The entry point of the Rust Programming Language is under control of the Serbian National Register of Internet Domain Names (.rs).
• rustup.rs does not support authenticated DNS responses (DNSSEC).
• The footgun of not being HSTS preloaded is still present.
  https://www.hardenize.com/report/rustup.rs/1558088762#www_hsts
  https://hstspreload.org/?domain=rustup.rs
• Is rustup.sh owned by the Rust project? I make this mistake too often! :-/

[pietroalbini]

It looks like there's an S3 limitation there: https://serverfault.com/q/820939/44697.

We have infra in place to fix this, I'll set it up in the coming days.

The entry point of the Rust Programming Language is under control of the Serbian National Register of Internet Domain Names (.rs).

Not something we can fix unfortunately :(

rustup.rs does not support authenticated DNS responses (DNSSEC).

As far as I can see the .rs TLD doesn't support DNSSEC at all.

The footgun of not being HSTS preloaded is still present.

Does curl actually check the preload list? Doesn't seem so after a quick search. Anyway my comment on the other issue still applies here.

Is rustup.sh owned by the Rust project? I make this mistake too often! :-/

Nope, it's not in any of the domain registrars used by the infra team.

[kinnison]

Is rustup.sh owned by the Rust project? I make this mistake too often! :-/

@nrc Do you know who owns rustup.rs? @brson ?

[pietroalbini]

@kinnison rustup.rs is in an account controlled by the infra team.

[kinnison]

@pietroalbini oops, I'm good at misreading things :D thanks.

[pietroalbini]

HSTS is now enabled on rustup.rs!

[Darkspirit]

Please reopen. HSTS is not enabled for first-time visitors:
https://hstspreload.org/?domain=rustup.rs

[pietroalbini]

@Darkspirit opened a new issue to track that: https://github.com/rust-lang/rustup.rs/issues/1987