Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2011-02-03 Thread Ian Hickson
On Thu, 11 Nov 2010, Ingo Chao wrote: For automated error reporting, say for a HTTPS mashup page with 3rd party advertisement content, I would like to have a security warning thrown for the mixed content situation (HTTPS mixed with HTTP content), accessible from JavaScript. On Sat, 13 Nov

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-13 Thread Anne van Kesteren
On Fri, 12 Nov 2010 23:02:16 +0100, Ingo Chao i4c...@googlemail.com wrote: An event that says 'something was loaded insecurely' would be helpful. No need to report the URL, and no need to have the ability to prevent the loading in the first place. The bug reporting tool of the mashup page

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-13 Thread Ingo Chao
2010/11/13, Anne van Kesteren ann...@opera.com: On Fri, 12 Nov 2010 23:02:16 +0100, Ingo Chao i4c...@googlemail.com wrote: An event that says 'something was loaded insecurely' would be helpful. No need to report the URL, and no need to have the ability to prevent the loading in the first

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-13 Thread timeless
On Sat, Nov 13, 2010 at 2:52 PM, Ingo Chao i4c...@googlemail.com wrote: The mashup combines components, some of them are not under my control. The advertisement service provides 3rd party ads, they will change often. Including the ad service means that I never know if and when someone throws

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-13 Thread Gregory Maxwell
On Sat, Nov 13, 2010 at 5:37 PM, Ingo Chao i4c...@googlemail.com wrote: 2010/11/13 timeless timel...@gmail.com: [snip] Good contracts with the component's providers of a mashup are neccessary, but not sufficient to resolve the mixed https/http issue in reality. Another ingredient for a secure

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-12 Thread Daniel Veditz
On 11/11/10 12:06 PM, Ingo Chao wrote: For https mashups, users will see always a few security warnings in IE or Chrome, because a few components will be delivered via http. Thats good, but I would like to know that, too. The mashup should report that automatically. Hence my question

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-12 Thread Ingo Chao
2010/11/12, Daniel Veditz dved...@mozilla.com: On 11/11/10 12:06 PM, Ingo Chao wrote: For https mashups, users will see always a few security warnings in IE or Chrome, because a few components will be delivered via http. Thats good, but I would like to know that, too. The mashup should report

[whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-11 Thread Ingo Chao
For automated error reporting, say for a HTTPS mashup page with 3rd party advertisement content, I would like to have a security warning thrown for the mixed content situation (HTTPS mixed with HTTP content), accessible from JavaScript. Would that be possible to specify? Thanks Ingo -- Ingo

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-11 Thread timeless
On Thu, Nov 11, 2010 at 12:17 PM, Ingo Chao i4c...@googlemail.com wrote: For automated error reporting, say for a HTTPS mashup page with 3rd party advertisement content, I would like to have a security warning thrown for the mixed content situation (HTTPS mixed with HTTP content), accessible

Re: [whatwg] Encrypted HTTP and related security concerns - make mixed content warnings accessible from JS?

2010-11-11 Thread Ingo Chao
2010/11/11, timeless timel...@gmail.com: On Thu, Nov 11, 2010 at 12:17 PM, Ingo Chao i4c...@googlemail.com wrote: For automated error reporting, say for a HTTPS mashup page with 3rd party advertisement content, I would like to have a security warning thrown for the mixed content situation