HTTPS Everywhere extension for Microsoft Edge

[martinsuchan]

Microsoft released in July 2016 Windows 10 Anniversary Update which comes with a new version of Microsoft Edge browser that supports Extensions.
These extensions use similar structure and API as Chrome extensions - porting the existing HTTPS Everywhere extension should be then really easy.

Documentation for developing Edge extensions is available here:
https://developer.microsoft.com/en-us/microsoft-edge/platform/documentation/extensions/

[TheRyuu]

Just to update the AU is now out for Windows 10 and so is the documentation for developing extensions[1]. Hopefully minimal modifications are required since it is just the WebRequest API with some minor technical differences to Chrome's.

Just for reference uBlock Origin requires minimal changes to get it working[2].

[1] https://developer.microsoft.com/en-us/microsoft-edge/platform/documentation/extensions/
[2] gorhill/uBlock#1486 (comment)

[jeremyn]

The current HTTPS-Everywhere development and build process is *nix-centric. I was recently told here that people using Windows 10 who want to contribute to HTTPS-Everywhere need to use some sort of Linux VM. However the equivalent of ChromeDriver for Edge, WebDriver, which allows for command-line browser testing, must be installed on Windows 10. So it seems to me that the build process needs to be made to work on Windows 10, or at least a parallel build process just for Edge needs to be created, before an Edge extension could be created.

[Artoria2e5]

MS Edge uses the common WebExtensions API, which is used by Opera as well. For me it's fine to have the tests come later than the proof of concept alphas.

P.S. WebDriver is also a common W3C API.

Regarding the conversion tool, It looks generally like a lint tool that also adds a bridge for the chrome object. Attached is a sample of its bridge scripts, generated for Stylish 1.3.1-1. (Warning: heavy use of ES6.)
bridge.zip

[martinsuchan]

Note that Windows 10 Creators Update was just released and it contains even wider API set for Edge Extensions:
https://docs.microsoft.com/en-us/microsoft-edge/extensions/api-support/extension-api-roadmap

[elyscape]

@WilliamFeely I don't see how that's relevant to the purpose of this extension.

[jeremyn]

Let's not turn this into a discussion about boycotting Windows or Edge. HTTPS Everywhere means providing HTTPS rewrite protection wherever possible, including on Edge.

I believe @Hainish has the WebExtension rewrite on his to-do list. If anyone wants to help make HTTPS Everywhere available on Edge, that effort is welcome, and they should coordinate their work with him.

[xt0rted]

I was trying to get Stylus working in Edge and ran into a number of issues where html5 templates & the extensions api aren't feature complete compared to Chrome, even in v15 which was released this/next week.

I'm not sure if templates are used anywhere but the DocumentFragment api is only partially implemented so properties like .firstElementChild don't work.

The extensions api I had issues with was

chrome.tabs.query({ currentWindow: true }, function(tabs) { ... });

When the currentWindow option is set to true, even with other options, the result is always undefined. Setting it to false returns a result, but that's not how either plugin is using it so it's a blocking issue. I reached out to the Edge team about this and they passed the question on to a team member to look into and confirm if it's a bug, but I haven't heard anything on it yet.

[robinhood2014]

Well, this is not good. I replaced every instance of "chrome.xxx" (where "xxx" represents functions of Google Chrome) with "myBrowser.xxx", and even removed all comments from all JavaScript files referenced in manifest.json, and the Edge Extension Toolkit is still reporting manifest.json as malformed.
HTTPS Everywhere Prototype.zip

[Artoria2e5]

The toolkit does some heavy linting on the manifest. Have you checked for errors around things like the icon stuffs?

[robinhood2014]

According to the toolkit, only the manifest file has errors.

[Artoria2e5]

I fed the 2017.4.5 directory to the toolkit. This time it spits out the error as:

manifest.json  .author : invalid type: object (expected string)

The current value provided is in fact a violation of WebExtentions Spec, as per https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/author. Fixing that gives a "ready to go" message for the extension.

[gloriousjob]

Hi all,

I created this zip and it seems to work on my machine. Just extract it and sideload the extension.
https_everywhere_edge.zip

The process I followed was fairly simple (though it took a few tries to figure out and get working):

1. Extracted the chrome extension.
2. Opened manifest.json and made the following changes:
   a. changed author to "author": "eff.software.projects@gmail.com" since braces are non-standard (https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/author)
   b. Added the following subproperty to "background": ,"persistent": true
   c. Added the following property: "locale": "en"
   d. Added the following property: "minimum_edge_version": "33.14281.1000.0"
3. Opened all js files with chrome references and placed this code at the top:
   if (typeof msBrowser !== 'undefined') { chrome = msBrowser; } else if (typeof browser !== 'undefined') { chrome = browser; }

[elyscape]

@gloriousjob Why are you using !== for checking typeof msBrowser but != for typeof browser?

[saschanaz]

@gloriousjob Why msBrowser? I think Edge uses browser.

[gloriousjob]

@elyscape Good call! I copied that code from elsewhere which said that is what MS was doing. It makes sense to do an actual equals there. I've updated my previous comment and uploaded a new zip.

@saschanaz I've read that Edge was using msBrowser and browser is where the browsers are trying to standardize to. It's safer to have both just in case. If msBrowser is wrong, the if statement will skip it anyway.

[gmng]

I tried gloriousjob's zip and loaded the folder in EDGE but it does not redirect the link what I tried to HTTPS. It was an http link in a gmail mail but it does not redircted it to the https proto. (the page has https access too, I tried it manually in the address bar)

[elyscape]

@gmng Does HTTPS Everywhere redirect the site in question when using Chrome?

[gmng]

@elyscape No, it doesn't. I use this extension in FF with no problem, and now I installed it in chrome to test, but no, it does not redirect the page. It's a parcel tracking page (GLS) and has both http and https access. Same behaviour like in EDGE, when I insert the link in plain HTTP it doesn't redirect to https. When I change the proto manually to httpS in the address bar, I can access the page over SSL.

[gloriousjob]

@elyscape thanks for asking the question @gmng so the edge extension I made is just a port of the chrome extension. This is really an issue with the chrome extension. Maybe you should write up a separate issue?

…

On April 22, 2017 3:53:12 AM gmng ***@***.***> wrote: @elyscape No, it doesn't. I use this extension in FF with no problem, and now I installed it in chrome to test, but no, it does not redirect the page. It's a parcel tracking page (GLS) and has both http and https access. Same behaviour like in EDGE, when I insert the link in plain HTTP it doesn't redirect to https. When I change the proto manually to httpS in the address bar, I can access the page over SSL. -- You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: #5101 (comment)

[jeremyn]

If anyone wants to let people know about a site that needs an HTTPS Everywhere redirect, you can just note it in issue #3069.

[nicole-ashley]

@gloriousjob msBrowser is not used by Edge, it can be removed entirely.

What are the next steps now for Edge support?

[martinsuchan]

So what's the status of the extension for Edge, any blockers I can help with or ETA when it could be ready?

[craige1]

With the converter and the steps gloriousjob did, it seems extremely easy to make this. Can i push for this to be put into the store officially?

[jeremyn]

@Hainish has authority here and I don't want to step on his toes, but, just to set expectations, right now I believe the big technical focus is on converting the XUL/XPCOM version of the Firefox extension to use WebExtensions in time for the Firefox 57 release where XUL/XPCOM extensions won't work anymore. See here for related tagged issues. Once the Firefox migration is public and settled then @Hainish / the EFF might decide to work on the Edge version. Firefox 57 is due out in November 2017 so Edge might not have priority until then at least.

[Hainish]

Thanks @jeremyn. In addition, our legal department needs to look at whether we are able to comply with the MS developer license agreement.

[nicole-ashley]

I was able to install HTTPS Everywhere on Edgium directly from the Chrome Web Store. Everything appears to be functioning correctly.

[dxgldotorg]

@dxgldotorg well, that would mean uBlock Origin or similar extensions are similarly illegal, since the block lists include not only NSFW websites, but also some that are most likely illegal in any jurisdiction.

Is there a reason that HTTPS Everywhere (which is not a blocking extension) couldn't make their lists separate from the extension? This would also have the added advantage of being able to update lists without having to update the extension itself.

[Hainish]

@dxgldotorg we already do this: https://github.com/EFForg/https-everywhere/blob/master/docs/en_US/ruleset-update-channels.md

[pipboy96]

@dxgldotorg We do bundle the rulesets with the extension too though.

[nicole-ashley]

uBlock operates in a similar way. Every release goes out with the latest set of rules, so you are up and running immediately. Sometimes background update processes don't get to run for a little while, which would mean the extension is inoperable until then.

[zoracon]

So it looks like if they keep the "Download extensions from other stores" model with the future stable release of "Edgium" then we may not even have to do a separate release to the Edge marketplace! Will update if this changes.

[nicole-ashley]

Yes, for power users at least. But if we want discoverability for the layperson (maybe, maybe not?) it should be in the Edge store as well. The good news is that, at least so far, the auto-pull seems to be working.

[zoracon]

Yes, for power users at least. But if we want discoverability for the layperson (maybe, maybe not?) it should be in the Edge store as well. The good news is that, at least so far, the auto-pull seems to be working.

There's pretty short and clear instructions they provide we can refer to on the site to make sure the user is directed properly. It just makes the release process longer. But if it has to be done, it can since this is now an obtainable reality.

[nicole-ashley]

It just makes the release process longer.

Not necessarily - once you've set up the storefront (and providing this process passes Microsoft's criteria and they stick with it) releases are automatically pulled from the Chrome store. The developer doesn't need to do anything extra once initially linking it, they just release for Chrome as usual and the Edge store updates.

The only extra work is if you want to update the storefront (description, images, etc).

[pipboy96]

@zoracon @andresbase What's the current status of this?

[dxgldotorg]

Since EdgeHTML Edge is about to be replaced with Chromium Edge, there may be no more point in developing the Edge addon, as Chromium Edge is fully compatible with Chrome extensions, and can even access the Chrome Web Store to download and install extensions.

[pipboy96]

@dxgldotorg Do you think we shouldn't publish the extension in Edge's extension store?

[zoracon]

@zoracon @andresbase What's the current status of this?

This is being held up by the Manifest V3 planning and auditing. "Edgium" is still in Dev channel at the moment so monitoring when they will officially publicly release

[iNViTiON]

@zoracon It's in public beta channel. Not only in dev channel. https://blogs.windows.com/windowsexperience/2019/08/20/introducing-microsoft-edge-beta-be-one-of-the-first-to-try-it-now/

[zoracon]

@zoracon It's in public beta channel. Not only in dev channel. https://blogs.windows.com/windowsexperience/2019/08/20/introducing-microsoft-edge-beta-be-one-of-the-first-to-try-it-now/

Right, however my reasoning still applies. Hopefully there is news soon for public release since they have it on Beta

[pipboy96]

@zoracon Would it make sense to start preparing now to get ready for official release? Manifest V3 should be prioritized though.

[FranklinYu]

Right, however my reasoning still applies.

Sorry but I disagree. This reasoning holds for Dev channel, but public beta should be a signal for browser extension developer to start testing their extensions. For example if HTTPS-Everywhere break in Chrome beta I would report a bug here instead of waiting for the bug to propagate into Chrome stable.

[zoracon]

Right, however my reasoning still applies.

Sorry but I disagree. This reasoning holds for Dev channel, but public beta should be a signal for browser extension developer to start testing their extensions. For example if HTTPS-Everywhere break in Chrome beta I would report a bug here instead of waiting for the bug to propagate into Chrome stable.

@FranklinYu that's a good point about testing, but there has been a few reporting stability out of the extension since the dev channel. And my last comment was more geared toward the fact Chrome plans on changing this extension ecosystem in a very large way. So I have been committing more time and resources to Manifest V3 in the Chrome environment.

I admit there has not been much publicly said from HTTPSE about Manifest V3. But that's also due to the fact that the new API has new updates even up until the past few weeks. We have publicly asked certain features from the API for HTTPSE to still function. So far they have been 75% of the way granted.
#17268

[ExE-Boss]

That’s probably because webRequest can do anything with web requests, like redirecting the request to HTTPS or blocking it entirely, and as such, is also used by adblockers to block remote advertisments and trackers, and because of that, Google’s management wants developers to switch to declarativeNetRequest, which greatly limits what can be done and increases their advertising margins.

Without webRequest, adblockers can only block advertisements by hiding them with display: none !important; in a user origin styleshhet, but by that point, the request has already reached the advertiser’s servers, and so they can still track you.

[pipboy96]

@ExE-Boss I guess when this hits we will have to shift focus from Chrome to Firefox and Chromium forks (Brave, eloston's Ungoogled Chromium, etc).

[nicole-ashley]

It will be interesting to see what Microsoft does about Manifest v3 in the new Edge.

[nicole-ashley]

Microsoft have not taken a stance on Manifest v3 yet. I've even asked their dev team personally.

[zoracon]

HTTPS Everywhere is now in the Edge store. Please report issues to Github if you see them :)
https://microsoftedge.microsoft.com/addons/detail/fchjpkplmbeeeaaogdbhjbgbknjobohb

[pipboy96]

@zoracon There is a problem with an icon: