This repository has been archived by the owner on Jun 10, 2020. It is now read-only.
Bad bug with logic around bad certificate chains #224
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This means ~50 domains go from Yes to No, taking it from 32 to 27%. ~5 of these should still be Yes, but are No because of other bugs that are now revealed by removing the other bug that masked it.
|
Good catch! Adding a new issue to update |
juliaelman
pushed a commit
that referenced
this pull request
Jun 15, 2015
Bad bug with logic around bad certificate chains
This was referenced Jun 15, 2015
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
My logic that checked to see if a domain was using a bad certificate chain (which indicates the site is using HTTPS, even if it's not fully valid) failed to also make sure the domain's cert wasn't also using a bad hostname (which indicates the site is not using HTTPS, whether or not the chain is good).
The fix is in 52f82ef, which brings the number of sites that Use HTTPS down from 381 to 328, out of 1,194 domains. That goes from 31.9% to 27.4%, a loss of 4.5%, which makes the big number go from 32 to 27.
A mild silver lining is that a few of those domains actually do use HTTPS, and fixing this bug revealed a smaller bug afflicting those. Fixing that should at least bring this up to something that rounds to 28%, and since the site is currently at 31% (before deploying #221), we can limit the visual damage to 3%. I'm also in the middle of a scan of the last week since #221, which I'm hoping will lead to greater uptake.
I think the result of all this should be a part of the site, maybe part of the
/about/page, which has some prose or a list mentioning methodology changes and some progress milestones, for transparency about the changes.Downstream of #223, which should be merged first.