search

claustromaniac / httpz

Fat-free hardenable opportunistic encryption for Firefox
https://addons.mozilla.org/firefox/addon/httpz/
GNU General Public License v3.0
62 stars 5 forks source link

Peculiarities with yourjavascript.com – maybe involving another extension #52

Closed grahamperrin closed 4 years ago

grahamperrin commented 4 years ago

Firefox 71.0 with HTTPZ 0.12.0, Wayback Machine 1.8.6 and other extensions.

http://yourjavascript.com/

image

IIRC a subsequent manual visit to http://yourjavascript.com/ resulted in an attempt to use HTTPS but there was no HTTPZ icon.

Also IIRC I had this (can't remember when or why I disabled the option):

☐ Handle non-standard redirections to HTTP

That's now enabled.

claustromaniac commented 4 years ago

IIRC a subsequent manual visit to http://yourjavascript.com/ resulted in an attempt to use HTTPS but there was no HTTPZ icon.

If I had to take a guess, the server's administrator(s) probably upgraded requests to HTTPS temporarily to test something. It happens. Alternatively, they might have misconfigured something. Who knows.

As things are now, the icon is meant to appear in these three scenarios:

  1. After HTTPZ upgrades an HTTP request to HTTPS (to allow users to exclude the site easily).
  2. After HTTPZ does not upgrade an HTTP request because the site is in the list of exclusions (to allow users to remove the site from the exclusions easily).
  3. After you visit a site over HTTPS (by whatever means) that happens to be in the list of exclusions (to inform users that HTTPZ did not have anything to do with the site being visited over HTTPS, and to allow them to remove the site from the exclusions easily).

I don't know if you're suggesting that the icon should also be displayed in this particular scenario, but the whole point of using a page action is to display it only when it is relevant to do so, and there is nothing for HTTPZ to do when you visit a site over HTTPS due to reasons out of its reach/control.

I don't want the extension to behave unexpectedly to users, but showing the page action in this scenario, in addition to the scenarios we already have, would result in the latter being displayed every single time users visit sites over HTTPS. In fact, the only time HTTPZ wouldn't display the icon would be after it fails to upgrade a request and falls back to HTTP. Sounds like overkill to me.

grahamperrin commented 4 years ago

Yeah, difficult (for me) to tell what's occurring here.

Again today I found http://yourjavascript.com/ intercepted – more than once – by the Wayback Machine extension, with just the two extensions enabled in a test profile.