[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #8774 [EFF-HTTPS Everywhere]: Disable mixed content rulesets on FF 23+
#8774: Disable mixed content rulesets on FF 23+
----------------------------------+-----------------------------------------
Reporter: pde | Owner: micahlee
Type: defect | Status: assigned
Priority: critical | Milestone: HTTPS-E 4.0dev8
Component: EFF-HTTPS Everywhere | Version:
Keywords: | Parent: #6975
Points: | Actualpoints:
----------------------------------+-----------------------------------------
Comment(by mikeperry):
Please make sure it is easy to re-enable these rules. I am going to
disable MCB in the 24-ESR based TBB until I have time to fix the MCB
implementation and its bugs (including the nsIContentPolicy security
issues not related to HTTPS-Everywhere, of which there are several).
Also note that in the meantime, if we leave MCB enabled for stock Firefox
HTTPS-Everywhere users, ruleset authors will try to write rules that fail
for opaque and hard-to-diagnose reasons (due to nsIContentPolicy issues).
This will undoubtedly discourage that volunteer community, and may lead
new volunteers to conclude our software is simply broken.
I really think we're letting Mozilla force us to shoot off our own foot
with this MCB stuff (or at least outsource their dev workload on MCB to
us), and it seems to be entirely because they've discovered that it
matters more to us that MCB is done correctly and securely than it matters
to them :/.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/8774#comment:9>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs