Re: [HTTPS-Everywhere] wrong FAQ "Q. Why use a whitelist of sites that support HTTPS?"

2014-01-13 Thread Drake, Brian
Here’s a few other places with outdated addresses: “Q. Why use a whitelist of sites that support HTTPS? Why can't you try to use HTTPS for every last site, and only fall back to HTTP if it isn't available?” This is the section already being discussed with regard to the LiveJournal example. The Wi

[HTTPS-Everywhere] Outdated FAQ answer: “Q. What's the meaning of the broken padlock icon at the bottom of the browser …”

2014-01-13 Thread Drake, Brian
Regarding this HTTPS Everywhere FAQ section: “Q. What's the meaning of the broken padlock icon at the bottom of the browser, or the warning that a site contains "insecure information" or "unauthenticated content"?” Anyone who’s used Firefox recently should see straight away that there are some big

Re: [HTTPS-Everywhere] [HTTPS-E Rulesets] HTTPS Everywhere 3.4.5 / Chrome 2014.1.3 released

2014-01-13 Thread Drake, Brian
I don’t really know anything about Chrome and Opera add-ons, but I am surprised to see something about a “Mozilla addon store” being updated. This add-on is not on https://addons.mozilla.org/ and I don’t know what else it could be referring to. -- Brian Drake All content created by me: Copyright<

Re: [HTTPS-Everywhere] persistent user-generated rules

2014-01-13 Thread Drake, Brian
I’m just throwing some ideas out there; I’m not in a position to implement anything like this now: 2. Better way to upload rules E-mail is (mostly) not secure in any sense. Other people can read it, change it, and see who you are. It really seems like a bad thing, even though we seem to be stuck

[HTTPS-Everywhere] SSL Observatory – Old Logo

2014-01-13 Thread Drake, Brian
The SSL Observatory Preferences window has a banner at the top, which, I just noticed, has the old HTTPS Everywhere logo in it. Has anyone else noticed that? It seemed like the old logo had been gone for a while now, so this was a surprise to me. -- Brian Drake All content created by me: Copyrig

Re: [HTTPS-Everywhere] [HTTPS-E Rulesets] HTTPS Everywhere 3.4.5 / Chrome 2014.1.3 released

2014-01-13 Thread Yan Zhu
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 01/13/2014 06:00 AM, Drake, Brian wrote: > I don’t really know anything about Chrome and Opera add-ons, but I > am surprised to see something about a “Mozilla addon store” being > updated. This add-on is not on https://addons.mozilla.org/ and I

Re: [HTTPS-Everywhere] [HTTPS-E Rulesets] HTTPS Everywhere 3.4.5 / Chrome 2014.1.3 released

2014-01-13 Thread Drake, Brian
Yay! At the risk of being annoying, with all my recent messages about the FAQ, this one might need updating soon: “Q. Why isn't HTTPS Everywhere available for download from addons.mozilla.org like most other Firefox add-ons?” It would also be interesting to know what the reason is for this chang

Re: [HTTPS-Everywhere] redesign suggestions

2014-01-13 Thread Drake, Brian
Are you trying to make it friendlier for people who don’t have a good understanding of how rulesets etc work? I noticed that you said “websites” instead of “rules” or “rulesets” (by the way, the original version says “rules” when it seems to mean “rulesets”). Will people understand how they can be

Re: [HTTPS-Everywhere] redesign suggestions

2014-01-13 Thread Drake, Brian
Another thing I forgot to mention in my previous reply: I prefer the term “secure connection” instead of “encrypted connection”, because, as far as I know, the word “encrypted” refers only to data confidentiality, whereas other aspects of security are just as important. https://www.eff.org/https-e

Re: [HTTPS-Everywhere] wrong FAQ "Q. Why use a whitelist of sites that support HTTPS?"

2014-01-13 Thread Claudio Moretti
> On Thu, Aug 29, 2013 at 0941 (UTC), Micah Lee wrote: > >> On 08/27/2013 02:05 PM, Claudio Moretti wrote: >> > On Sun, Aug 18, 2013 at 10:05 AM, Nicklas Holmkvist >> > mailto:[email protected]>> wrote: >> > >> > I couldn't get your HTTP and HTTPS comparison example work in >> neither

Re: [HTTPS-Everywhere] persistent user-generated rules

2014-01-13 Thread Claudio Moretti
Hey all, On Mon, Jan 13, 2014 at 4:42 AM, John Stinson wrote: > With respect to: > > 2. better way to upload rules >>> I agree with Claudio that email is probably not a great way to do this. >>> >> > Is there a measure of how non-technical / easy the submission of new or > changed rules should be

[HTTPS-Everywhere] Broken / bad rule feedback mechanism

2014-01-13 Thread John Stinson
Hey, I think this is independent of other discussions going on right now so I created a new thread (sorry for moar email). Has there ever been discussion of having a mechanism for users to report a bad transition (as a result of a bad rule) directly from the plugin? For instance, someone is redir

Re: [HTTPS-Everywhere] Broken / bad rule feedback mechanism

2014-01-13 Thread Claudio Moretti
There might be a potential concern here: if an user is browsing a restricted page, with some information in the URL, we might have a little too much information disclosure... On the other hand, stripping down the URL to the domain would probably be useless, because if the rule is tested (and it is)

Re: [HTTPS-Everywhere] persistent user-generated rules

2014-01-13 Thread Drake, Brian
On Mon, Jan 13, 2014 at 2008 (UTC), Claudio Moretti wrote: > Hey all, > > [snip] > > > > E-mail is (mostly) not secure in any sense. Other people can read it, >> change it, and see who you are. It really seems like a bad thing, even >> though we seem to be stuck with it. >> > > I'm sorry, but I do

Re: [HTTPS-Everywhere] [HTTPS-E Rulesets] HTTPS Everywhere 3.4.5 / Chrome 2014.1.3 released

2014-01-13 Thread Yan Zhu
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 01/13/2014 07:14 AM, Drake, Brian wrote: > Yay! > > At the risk of being annoying, with all my recent messages about > the FAQ, this one might need updating soon: > > “Q. Why isn't HTTPS Everywhere available for download from > addons.mozilla

Re: [HTTPS-Everywhere] Broken / bad rule feedback mechanism

2014-01-13 Thread Yan Zhu
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hey guys, these are great questions too. Yes, I secretly implemented an automated bug reporter for HTTPS Everywhere (Firefox) that submits a bug report with user-selected info (OS, domain, URL, other addons installed, comments) whenever you disable a

[HTTPS-Everywhere] Ruleset Name Character Encoding

2014-01-13 Thread Drake, Brian
Anyone who has HTTPS Everywhere 3.4.5 (currently the latest stable version), try opening the “Enable / Disable Rules” page and scrolling down to the end of the list. The last ruleset listed should be the one from UPV.cz.xml, but the name listed here looks very different (this ruleset disabled by de

Re: [HTTPS-Everywhere] Ruleset Name Character Encoding

2014-01-13 Thread Drake, Brian
I downloaded UPV.cz.xml and Zurcher_Kantonalbank.xml from Git. When I opened them in Notepad, they were fine. When I opened them in WordPad, the names were garbled in a similar way to the HTTPS Everywhere preferences window. I think the problem in both cases is that it is trying to read text as