Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2011-02-03 Thread Ian Hickson
On Thu, 11 Nov 2010, Ingo Chao wrote: > > For automated error reporting, say for a HTTPS mashup page with 3rd > party advertisement content, I would like to have a security warning > thrown for the mixed content situation (HTTPS mixed with HTTP content), > accessible from JavaScript. On Sat, 13

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-13 Thread Gregory Maxwell
On Sat, Nov 13, 2010 at 5:37 PM, Ingo Chao wrote: > 2010/11/13 timeless : [snip] > Good contracts with the component's providers of a mashup are > neccessary, but not sufficient to resolve the mixed https/http issue > in reality. Another ingredient for a secure mashup would be the event > I am pro

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-13 Thread Ingo Chao
2010/11/13 timeless : > On Sat, Nov 13, 2010 at 2:52 PM, Ingo Chao wrote: >> The mashup combines components, some of them are not under my control. >> The advertisement service provides 3rd party ads, they will change >> often. > >> Including the ad service means that I never know if and when >> s

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-13 Thread timeless
On Sat, Nov 13, 2010 at 2:52 PM, Ingo Chao wrote: > The mashup combines components, some of them are not under my control. > The advertisement service provides 3rd party ads, they will change > often. > Including the ad service means that I never know if and when > someone throws in http content

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-13 Thread Ingo Chao
2010/11/13, Anne van Kesteren : > On Fri, 12 Nov 2010 23:02:16 +0100, Ingo Chao > wrote: >> An event that says 'something was loaded insecurely' would be helpful. >> No need to report the URL, and no need to have the ability to prevent >> the loading in the first place. >> >> The bug reporting too

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-13 Thread Anne van Kesteren
On Fri, 12 Nov 2010 23:02:16 +0100, Ingo Chao wrote: An event that says 'something was loaded insecurely' would be helpful. No need to report the URL, and no need to have the ability to prevent the loading in the first place. The bug reporting tool of the mashup page would inform me that the m

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-12 Thread Ingo Chao
2010/11/12, Daniel Veditz : > On 11/11/10 12:06 PM, Ingo Chao wrote: >> For https mashups, users will see always a few >> security warnings in IE or Chrome, because a few components will be >> delivered via http. Thats good, but I would like to know that, too. >> The mashup should report that autom

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-12 Thread Daniel Veditz
On 11/11/10 12:06 PM, Ingo Chao wrote: > For https mashups, users will see always a few > security warnings in IE or Chrome, because a few components will be > delivered via http. Thats good, but I would like to know that, too. > The mashup should report that automatically. Hence my question > rega

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-11 Thread Ingo Chao
2010/11/11, timeless : > On Thu, Nov 11, 2010 at 12:17 PM, Ingo Chao wrote: >> For automated error reporting, say for a HTTPS mashup page with 3rd >> party advertisement content, I would like to have a security warning >> thrown for the mixed content situation (HTTPS mixed with HTTP >> content), a

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-11 Thread timeless
On Thu, Nov 11, 2010 at 12:17 PM, Ingo Chao wrote: > For automated error reporting, say for a HTTPS mashup page with 3rd > party advertisement content, I would like to have a security warning > thrown for the mixed content situation (HTTPS mixed with HTTP > content), accessible from JavaScript. >

[whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-11 Thread Ingo Chao
For automated error reporting, say for a HTTPS mashup page with 3rd party advertisement content, I would like to have a security warning thrown for the mixed content situation (HTTPS mixed with HTTP content), accessible from JavaScript. Would that be possible to specify? Thanks Ingo -- Ingo Ch