[RyanZAG]

Trying HTTPS first would still help a lot in other cases, such as the one in the article. None of the super cookie HSTS techniques would have worked in the first place if the browser had just always tried to use HTTPS first.

Probably other unknown vulnerabilities could be averted by just trying HTTPS first too. Not doing so should be considered bad practice, with or without HSTS.

[_Codemonkeyism]

Especially there is no reason, if I type news.ycombinator.com in my address bar to expand with http:// instead of https://