There are echoes of the net neutrality debate here, where one might argue that: beyond the OSI Application Layer (HTTP etc.) there is also the Layer Where The Browser Decides What Pixels To Show, and that we would want that new layer to be every bit as neutral as, say, whether T-Mobile can shape lower-layer video traffic based on its business partnerships.<p>But there's also a lot of nuance here. Imagine there was a law or regulation that said that a browser manufacturer must only write code that is agnostic to the current URL; imagine it said, say, that Edge developers cannot deploy code that detects that Edge is on google.com/chrome and decide based on that information to execute certain code.<p>Unfortunately, a version of this per-site customization is arguably exactly what Chrome does for the HSTS preload list: <a href="https://hstspreload.org/" rel="nofollow">https://hstspreload.org/</a> - and disallowing this would not be good for security at all!<p>And imagine if there is an urgent Chrome security fix that, as a side effect, causes the Outlook login screen to bug out - or any other mission-critical login page on the web. The most reasonable hotfix might be to push a quick fix that whitelists certain domains for the legacy behavior. But this, too, would be disallowed.<p>We definitely don't want to throw the baby out with the bathwater just because Microsoft got a little cute - arguably <i>too</i> cute - here.