Skip to content
This repository has been archived by the owner on Nov 6, 2023. It is now read-only.

Remove Network message for unknown hosts #17234

Merged
merged 1 commit into from
Jan 16, 2019
Merged

Conversation

zoracon
Copy link
Contributor

@zoracon zoracon commented Jan 11, 2019

This refers to #17192, where sites that don't exist get blocked by our EASE mode page.

The conclusive sentiment here on my part is that with or without EASE (BAUR) a site that doesn't exist (http or https), will pose little threat to our users. Since all major browsers provide a page explaining that the site does not exist.

This refers to EFForg#17192, where sites that don't exist get blocked
by our EASE mode page.
@zoracon zoracon requested review from Hainish and removed request for Hainish January 11, 2019 00:00
@zoracon zoracon changed the title Remove SSL message for unknown hosts Remove Network message for unknown hosts Jan 11, 2019
@Bisaloo Bisaloo added the EASE Encrypt all sites eligible (#16985) label Jan 11, 2019
@Hainish
Copy link
Member

Hainish commented Jan 14, 2019

I wonder why this was added in the first place. This error may triggered in an overly-broad manner. Can we check different errors that are returned with https://www.badssl.com/ to ensure this doesn't remove the interstitial for any hosts that are valid?

For testing, I've typically just done curl -O badssl.html https://www.badssl.com/ and replaced all the HTTPS links with HTTP within the HTML. This is necessary since direct links to HTTPS pages do not trigger the interstitial, and it's easier than copy/pasting the URL and removing the 's' each time.

@zoracon
Copy link
Contributor Author

zoracon commented Jan 15, 2019

I wonder why this was added in the first place. This error may triggered in an overly-broad manner. Can we check different errors that are returned with https://www.badssl.com/ to ensure this doesn't remove the interstitial for any hosts that are valid?

For testing, I've typically just done curl -O badssl.html https://www.badssl.com/ and replaced all the HTTPS links with HTTP within the HTML. This is necessary since direct links to HTTPS pages do not trigger the interstitial, and it's easier than copy/pasting the URL and removing the 's' each time.

I will check that out as well to make sure this doesn't hit other cases. I truly hope "unknown hosts" doesn't mean something else :(

@zoracon
Copy link
Contributor Author

zoracon commented Jan 16, 2019

I wonder why this was added in the first place. This error may triggered in an overly-broad manner. Can we check different errors that are returned with https://www.badssl.com/ to ensure this doesn't remove the interstitial for any hosts that are valid?
For testing, I've typically just done curl -O badssl.html https://www.badssl.com/ and replaced all the HTTPS links with HTTP within the HTML. This is necessary since direct links to HTTPS pages do not trigger the interstitial, and it's easier than copy/pasting the URL and removing the 's' each time.

I will check that out as well to make sure this doesn't hit other cases. I truly hope "unknown hosts" doesn't mean something else :(

@Hainish I went through badssl.com and have not seen "NS_ERROR_UNKNOWN_HOST" occur for other SSL errors. I did see ""NS_ERROR_CONNECTION_REFUSED"" occur sometimes for non existent sites. Maybe this is where the murky issues lied out with these errors? Maybe that jogs a memory?

@Hainish
Copy link
Member

Hainish commented Jan 16, 2019

@Hainish I went through badssl.com and have not seen "NS_ERROR_UNKNOWN_HOST" occur for other SSL errors. I did see ""NS_ERROR_CONNECTION_REFUSED"" occur sometimes for non existent sites. Maybe this is where the murky issues lied out with these errors? Maybe that jogs a memory?

Well, that works for me then. Thanks for looking into it, let's merge.

@Hainish Hainish merged commit b054192 into EFForg:master Jan 16, 2019
@zoracon zoracon deleted the ease-changes branch January 16, 2019 00:30
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
EASE Encrypt all sites eligible (#16985)
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants