-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Conversation
|
||
<securecookie host=".+" name=".+" /> | ||
|
||
<rule from="^https?://pleasuredome\." |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We don't redirect https domains.
<securecookie host=".+" name=".+" /> | ||
|
||
<rule from="^https?://pleasuredome\." | ||
to="https://www.pleasuredome." /> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is not a valid TLD
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This host serves a self-signed cert and the rule syntax has several issues.
Sorry, I didn't realise that self-signed certs are disallowed. Several parties have tried - and failed - to convince the webmaster to make use of a properly signed certificate. Therefore, this ruleset will remain inadmissible and I am closing the request. |
They are not disallowed, but then the rule should be |
Incidentally, it is neither mentioned here nor here that redirects from https URLs are a QA violation. Further, some existing rulesets exploit the fact that it can be done.
Why does HTTPS-Everywhere honour such rules (downgrade attribute notwithstanding) if it is not considered to be an acceptable practice? EDIT: Thanks for the merge! |
The documentation will soon be improved: https://github.com/EFForg/https-everywhere/pull/8193/files#diff-6a3371457528722a734f3c51d9238c13R230 We hope to get rid of the existing cases, but sadly some servers are really bad configured (see also discussion started in #7717). |
This ruleset covers the Pleasuredome Tracker and its associated forums.