mozilla-https-everywhere -- good to include?

[Russell Golden]

Hey, everyone. I was wondering, since Fedora is a very
security-conscious distro, if it'd be a good idea to include
mozilla-https-everywhere in the XFCE spin.

EFF link: https://www.eff.org/https-everywhere

It's already in the repos, too.
https://admin.fedoraproject.org/pkgdb/acls/name/mozilla-https-everywhere

Russell Golden
niveusluna(a)niveusluna.org
[phone]
--
"We are the Borg. Lower your shields and surrender your ships. We will
add your biological and technological distinctiveness to our own. Your
culture will adapt to service us. Resistance is futile."

[Ken Dreyer]

On Mon, Oct 24, 2011 at 12:17 PM, Russell Golden
<niveusluna(a)niveusluna.org&gt; wrote:
>  Hey, everyone. I was wondering, since Fedora is a very
>  security-conscious distro, if it'd be a good idea to include
>  mozilla-https-everywhere in the XFCE spin. 
This is one of my favorite addons, but it does break some sites. For
example, on wordpress.org, the stylesheets aren't served properly over
HTTPS. For this reason I don't think it should be turned on by
default.

I think what the EFF's doing with this plugin is a great idea, but I
don't know if the internet is ready for it yet.

- Ken

[Raphael Groner]

>  This is one of my favorite addons, but it does break some sites.
I agree that https everywhere can be quite useful, but it's not
guaranteed that there's the same content available via both http and
https on each web server, due to they are mostly two different protocols
for the server configuration. Especially there should be a valid
certificate available.

Further reading:
https://forum.xfce.org/viewtopic.php?id=5833

[Nick Schermer]

On Tue, Oct 25, 2011 at 8:39 PM, Raphael Groner <raphgro(a)web.de&gt; wrote:
> > This is one of my favorite addons, but it does break some sites.
>
>  I agree that https everywhere can be quite useful, but it's not
>  guaranteed that there's the same content available via both http and
>  https on each web server, due to they are mostly two different protocols
>  for the server configuration. Especially there should be a valid
>  certificate available.
>
>  Further reading:
>  https://forum.xfce.org/viewtopic.php?id=5833 
Https everywhere works with an approved list, so this does not affect
the xfce.org domain "problem", which is not a real problem actually.

Nick

[Christoph Wickert]

Am Montag, den 24.10.2011, 13:17 -0500 schrieb Russell Golden:
>  Hey, everyone. I was wondering, since Fedora is a very
>  security-conscious distro, if it'd be a good idea to include
>  mozilla-https-everywhere in the XFCE spin. 
Given the trouble we have with packaging extensions due to Mozilla's new
release policy, I'd say we should not include it, at least until we have
a proper way to detect broken extensions on a package management level.
Work on that is ongoing [2], but I am nut sure about the status.

Regards.
Christoph

[1]
http://lists.fedoraproject.org/pipermail/devel/2011-October/157948.html
[2]
http://lists.fedoraproject.org/pipermail/devel/2011-October/158028.html

[Thomas Spura]

On Mon, 24 Oct 2011 23:18:02 +0200
Christoph Wickert wrote:

>  Am Montag, den 24.10.2011, 13:17 -0500 schrieb Russell Golden:
>  > Hey, everyone. I was wondering, since Fedora is a very
>  > security-conscious distro, if it'd be a good idea to include
>  > mozilla-https-everywhere in the XFCE spin.
>  
>  Given the trouble we have with packaging extensions due to Mozilla's
>  new release policy, I'd say we should not include it, at least until
>  we have a proper way to detect broken extensions on a package
>  management level. Work on that is ongoing [2], but I am nut sure
>  about the status. 
It's a bit stalled, because:
	* The mozilla maintainers didn't respond yet.
	* Explicit requires are a bit problematic so conflicts would be
	  better. I asked on the fpc list for help [3], but no answer
	  yet too...

I don't want to work on drafting something, that will never be included
so I'd like to wait at least for an answer of fpc.
(But don't know when/if that will happen.)

Or does someone here on this list know how to code automatic conflicts?
That would be the cleanest solution...

	Tom

[3]
https://lists.fedoraproject.org/pipermail/packaging/2011-October/007963.html

[Russell Golden]

I put it an explicit require because it works not just with firefox,
but also with seamonkey, and RPM as far as I know isn't capable of
saying "requires firefox and/or seamonkey". The NoScript extension
packaged in Fedora does the same. In fact, I based my spec file on the
NoScript one.

Starting with Firefox 8, extensions will be assumed compatible by
default. I already keep up with the EFF's changes, but I don't know
how much good that will do.

I'm glad to hear the feedback. If stability is an issue, then that's
certainly a reason not to include it. Thank you all.

Russell Golden
niveusluna(a)niveusluna.org
[phone]
--
"We are the Borg. Lower your shields and surrender your ships. We will
add your biological and technological distinctiveness to our own. Your
culture will adapt to service us. Resistance is futile."