Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

security.mixed_content.upgrade_display_content #367

Closed
ArchangeGabriel opened this issue Mar 1, 2018 · 7 comments
Closed

security.mixed_content.upgrade_display_content #367

ArchangeGabriel opened this issue Mar 1, 2018 · 7 comments

Comments

@ArchangeGabriel
Copy link

(From https://www.ghacks.net/2018/02/24/firefox-60-https-upgrade-for-mixed-content/)

I think this is something we might want to set as on by default. This is better than purely blocking mixed-content, and I see no disadvantages over what we do currently.

@ArchangeGabriel
Copy link
Author

If I understand it well, it tries to load eventual http ressources of https website (i.e. mixed content) over https (i.e. does the job of the lazy web dev), meaning that it might reduces –already rare as you pointed– breakage.

P.S.: Re: 1433592; yes, that’s because you’ve mentioned it in #7 (comment)

@earthlng
Copy link
Contributor

earthlng commented Mar 1, 2018

There's probably a reason why they don't enable it by default just yet. I would wait.

@ArchangeGabriel
Copy link
Author

Pref name is this issue title (I don’t know if there is a ticket about it, would have to look more deeply at Martin’s post and follow links —don’t have time for that right now). The two mixed content blocks are made useless, because this new one can already not fallback to requesting insecure content on its own. I think it’s not enabled by default because it breaks sites the same way blocking passive mixed content does, and AFAIK this is not activated by default either (but we do).

@earthlng
Copy link
Contributor

earthlng commented Mar 1, 2018

@earthlng
Copy link
Contributor

earthlng commented Mar 1, 2018

The two mixed content blocks are made useless

it only upgrades passive display content, ie. images + media.

@ArchangeGabriel
Copy link
Author

OK, so it only makes blocking passive mixed content obsolete. Which make sense, since active mixed content has been blocked by default for a while.

@crssi
Copy link

crssi commented Oct 15, 2018

Mentioned on other topic as OT today (sorry). After that I have found it was already mentioned here in the past.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

4 participants