Yandex.xml

<!--
Disabled by https-everywhere-checker because:
Fetch error: http://yandex.net/ => https://yandex.net/: (51, "SSL: no alternative certificate subject name matches target host name 'yandex.net'")
	Other Yandex rulests:

		- Loginza.ru.xml
		- YaDi.sk.xml
		- Yandex.com.xml
		- Yandex.st.xml
		- Yandex.ua.xml
		- Yastatic.net.xml


    For any questions please contact Artyom Gavrichenkov <ximaera@yandex.ru>.

    I'm not in any way a Yandex employee, however, this set of rules is
    already working for a long time with all Yandex services, being used very
    intensively, and thus is being shared with community in order to prevent
    scam and stealing from Money.Yandex.ru (and other services as well).

    If you want to know about license terms, here they are:

    DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
    Version 2, December 2004

    Copyright (C) 2004 Sam Hocevar <sam@hocevar.net>

    Everyone is permitted to copy and distribute verbatim or modified
    copies of this license document, and changing it is allowed as long
    as the name is changed.

    DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

    0. You just DO WHAT THE FUCK YOU WANT TO.


    Nonfunctional domains:

        - clubs.ya.ru       (redirects to http)
	- my.ya.ru ¹
	- translate-blog.ya.ru ¹
	- yatechnologies.ya.ru ¹

		- yandex.ru subdomains:

			- m.auto ¹
			- business ³
			- cards ²
			- ir ²
			- iseg ²
			- kassa		(Reset
			- (www.)market ¹
			- narod ³
			- news ²
			- repo ³
			- shad ¹
			- soft ²
			- uslugi ¹
			- wdgt ⁴

	¹ Redirects to http
	² Dropped
	³ Refused
	⁴ 403


	Problematic domains:

		- img.encyc.yandex.net		(Mismatched, CN: yastatic.net)

		- www.advertising.yandex.ru	(Mismatched)
		- collection.yandex.ru		(Mismatched, CN: bar.yandex.com.tr)
		- mobile-feedback.yandex.ru	(Mismatched, CN: validator.yandex.ru)
		- money.yandex.ru		(Blocks Tor users)


	Partially covered domains:

		- (www.)yandex.ru		(www → ^)
		- video.yandex.ru		(Apparently breaks player)


	Fully covered domains:

		- disk-blog.ya.ru
		- p.ya.ru

		- awaps.yandex.by
		- awaps.yandex.com.au
		- awaps.yandex.kz

		- avatars.yandex.net
		- \d+.avatars.yandex.net
		- a.captcha.yandex.net
		- cache-default04e.cdn.yandex.net
		- cache-default05h.cdn.yandex.net
		- cache-default06f.cdn.yandex.net
		- download.cdn.yandex.net
		- \d.cs-ellpic.yandex.net
		- disk.yandex.net
		- favicon.yandex.net
		- img-css.friends.yandex.net
		- img.yandex.net
		- img-fotki.yandex.net
		- img\d-fotki.yandex.net
		- img.yandex.net
		- img5-fotki.yandex.net
		- st.kp.yandex.net
		- mdata.yandex.net
		- money.yandex.net
		- resize.yandex.net
		- lego.static.yandex.net
		- translate.yandex.net
		- wi.yandex.net

		- academy.yandex.ru
		- (www.)?advertising.yandex.ru		(www → ^)
		- welcome.advertising.yandex.ru
		- afisha.yandex.ru
		- an.yandex.ru
		- api.yandex.ru
		- awaps.yandex.ru
		- auto.yandex.ru
		- pda.auto.yandex.ru
		- ba.yandex.ru
		- blogs.yandex.ru
		- browsers.yandex.ru
		- bs.yandex.ru
		- calendar.yandex.ru
		- clck.yandex.ru
		- company.yandex.ru
		- contest.yandex.ru
		- algorithm.contest.yandex.ru
		- direct.yandex.ru
		- disk.yandex.ru
		- element.yandex.ru
		- events.yandex.ru
		- feedback.yandex.ru
		- m.feedback.yandex.ru
		- feedback2.yandex.ru
		- fotki.yandex.ru
		- help.yandex.ru
		- images.yandex.ru
		- img.yandex.ru
		- img-fotki.yandex.ru
		- kiks.yahdex.ru
		- legal.yahdex.ru
		- m.legal.yandex.ru
		- mail.yandex.ru

		- maps.yandex.ru
		- m.maps.yandex.ru
		- pda.maps.yandex.ru

		- partner.market.yandex.ru
		- mc.yandex.ru
		- mdata.yandex.ru
		- metrika.yandex.ru
		- mobile.yandex.ru
		- money.yandex.ru
		- partner.yandex.ru
		- pass.yandex.ru
		- passport.yandex.ru
		- pda-passport.yandex.ru
		- people.yandex.ru
		- pdd.yandex.ru
		- pogoda.yandex.ru
		- rabota.yandex.ru
		- m.rabota.yandex.ru
		- realty.yandex.ru
		- research.yandex.ru
		- site.yandex.ru
		- slovari.yandex.ru
		- sprav.yandex.ru
		- startups.yandex.ru
		- stat.yandex.ru
		- taxi.yandex.ru
		- tech.yandex.ru
		- translate.yandex.ru
		- tv.yandex.ru
		- video.yandex.ru
		- static.video.yandex.ru
		- webmaster.yandex.ru
		- widgets.yandex.ru
		- yabs.yandex.ru

		- yaca.yandex.ru
		- m.yaca.yandex.ru
		- pda.yaca.yandex.ru

		- m.zakladki.yandex.ru


	Insecure cookies are set for these domains:

		- .yandex.ru
		- academy.yandex.ru
		- afisha.yandex.ru
		- auto.yandex.ru
		- bs.yandex.ru
		- contest.yandex.ru
		- feedback2.yandex.ru
		- .fotki.yandex.ru
		- mail.yandex.ru
		- partner.market.yandex.ru
		- mobile.yandex.ru
		- pass.yandex.ru
		- pogoda.yandex.ru
		- rabota.yandex.ru
		- m.rabota.yandex.ru
		- realty.yandex.ru
		- slovari.yandex.ru
		- startups.yandex.ru
		- stat.yandex.ru
		- tech.yandex.ru
		- translate.yandex.ru
		- tune.yandex.ru


	Mixed content:

		- Images, on:
		- Images on ba.yandex.ru, blogs.yandex.ru, maps.yandex.ru, partner.market.yandex.ru, rabota.yandex.ru, yaca.yandex.ru from kiks.yandex.ru
			- m.feedback.yandex.ru from yastatic.net
			- m.legal.yandex.ru from img.yandex.net

		- favicons, on:
			- m.feedback.yandex.ru from img.yandex.net
		- favicon on legal.yandex.ru, m.legal.yandex.ru from yandex.st

-->
<ruleset name="Yandex" default_off='failed ruleset test'>

    <target host="moikrug.ru" />
    <target host="*.moikrug.ru" />
    <target host="ya.ru" />
    <target host="*.ya.ru" />
	<target host="awaps.yandex.*" />
    <target host="yandex.net" />
    <target host="*.yandex.net" />
    <target host="yandex.ru" />
    <target host="*.yandex.ru" />
		<!--
			Redirects to http:
						-->
		<!--exclusion pattern="^http://yandex\.ru/(video/$)" /-->
		<!--exclusion pattern="^http://m\.auto\.yandex\.ru/$" /-->
		<!--exclusion pattern="^http://market\.yandex\.ru/$" /-->
		<!--exclusion pattern="^http://www\.yandex\.ru/$" /-->
		<!--
			Exceptions:
					-->
		<exclusion pattern="^http://(?:www\.)?yandex\.ru/(?!cycounter(?:$|\?)|images/)" />

	<!--	Not secured by server:
					-->
	<!--securecookie host="^\.yandex\.ru$" name="^(Cookie_check|fuid01|my|yandexuid|ys)$" /-->
	<!--securecookie host="^(academy|events|startups)\.yandex\.ru$" name="^(express:sess:|express:sess\.sig)$" /-->
	<!--securecookie host="^afisha\.yandex\.ru$" name="^ys$" /-->
	<!--securecookie host="^(mc|bs)\.yandex\.ru$" name="^yabs-sid$" /-->
	<!--securecookie host="^contest\.yandex\.ru$" name="^CONTEST_LANG$" /-->
	<!--securecookie host="^feedback2\.yandex\.ru$" name="^feedback2-sid$" /-->
	<!--securecookie host="^\.fotki\.yandex\.ru$" name="^FSession_id$" /-->
	<!--securecookie host="^mail\.yandex\.ru$" name="^ni$" /-->
	<!--securecookie host="^(auto|pda\.auto|partner\.market|rabota|m\.rabota|realty)\.yandex\.ru$" name="^uid$" /-->
	<!--securecookie host="^mobile\.yandex\.ru$" name="^family$" /-->
	<!--securecookie host="^pass\.yandex\.ru$" name="^M_\w+_yandex_\w\w$" /-->
	<!--securecookie host="^pogoda\.yandex\.ru$" name="^yw_lc$" /-->
	<!--securecookie host="^realty\.yandex\.ru$" name="^from$" /-->
	<!--securecookie host="^slovari\.yandex\.ru$" name="^(slovari-state|uid)$" /-->
	<!--securecookie host="^stat\.yandex\.ru$" name="^uid$" /-->
	<!--securecookie host="^translate\.yandex\.ru$" name="^(first_visit_src|stoken)$" /-->

    <securecookie host="(?:academy|afisha|auto|pda\.auto|bs|contest|events|feedback2|mail|partner\.market|mc|mobile|pass|pogoda|rabota|m\.rabota|realty|slovari|startups|stat|translate|\.video)\.yandex\.ru$" name=".*" />


    <!--
        Rather than enumerating domains that support SSL,
        we enable SSL for all services and then exclude those
        which become broken:


        1. Public services without HTTPS support (or with broken support)
                                        -->
    <exclusion pattern="^http://(?:bar-widgets|cards|cs-ellpic|cs-thumb|dict|dzen|encyclopedia|images|lingvo|ll|metro|mirror|music|newmoscow|news|openid|presocial|rasp|twitter|wdgt|weather|wordstat|xml)\.yandex\.ru/" />
		<exclusion pattern="^http://www\.yandex\.ru/(?!cycounter(?:$|\?))" />

    <!--
            Needed for Yandex video player to work. 
                                                                                -->

    <exclusion pattern="^http://video\.yandex\.ru/iframe/" />
    <exclusion pattern="^http://[^.]+\.video\.yandex\.net/" />
    <exclusion pattern="^http://streaming\.video\.yandex\.ru/" />
    <exclusion pattern="^http://[^.]+\.video\.yandex\.ru/q-upload/" />
    <!--
        Remove this if you do never post entries or comments on my.ya.ru
                                        -->
    <exclusion pattern="^http://(?:www\.)?[^.]+\.ya\.ru/" />

    <!--    2. Simple redirections
                    -->
    <exclusion pattern="^http://probki\.yandex\.ru/" />
    <exclusion pattern="^http://(?:blogs|fotki|images|music|probki|video|wdgt|www)\.ya\.ru" />

    <!--    3. Narod.ru.

        Narod.ru doesn't use auth data from Yandex,
        so we don't need to encrypt its pages.
        The only exception is Narod.Disk, but it doesn't provide HTTPS
                                        -->
    <exclusion pattern="^http://narod\d*\.yandex\.ru/" />

    <!--    4. Search suggestions
                    -->
    <exclusion pattern="^http://suggest\.yandex\.ru/" />
    <exclusion pattern="^http://suggest-[a-z]+\.yandex\.(?:net|ru)/" />

    <!--    5. Webmaster
                -->
    <exclusion pattern="^http://content\.webmaster\.yandex\.ru/" />

    <!--    6. Mobile services
                    -->
    <exclusion pattern="^http://m\.yandex\.ru/" />

    <!--    7. Internet.Yandex.Ru (connection rate detection breaks with HTTPS)
                                            -->
    <exclusion pattern="^http://internet\.yandex\.ru/" />

    <!--    8. Various click counters and content storages.
                                -->
    <exclusion pattern="^http://(?:copy|hghltd|print|market-click\d+|wrz)\.yandex\.ru/" />

    <!--    9. Data clusters for Maps and Video
                            -->
    <exclusion pattern="^http://(?:jgo|vec\d+|stv\d+)\.maps\.yandex\.(?:net|ru)/" />
    <exclusion pattern="^http://[^.]+-tub(?:-[^.]+)?\.yandex\.(?:net|ru)/" />
    <exclusion pattern="^http://panoramas\.api-maps\.yandex\.ru" />

    <!--    10. More subdomains without SSL from Aleksey Kosterin.
                                    -->
    <exclusion pattern="^http://(?:business|collection|fx|kapersky|keyboard|large|market|nahodki|navigator|online|opera|punto|skype|time|zakladki)\.yandex\.ru/" />

    <!--    11. Some cert warnings.
                    -->
    <exclusion pattern="^http://(?:ie|soft)\.yandex\.ru/" />
		<!--
			Miscellanious:
					-->
		<exclusion pattern="http://(?:m\.auto|www\.market|repo|shad|static-maps|uslugi)\.yandex\.ru/" />


	<!--	Not secured by server:
					-->
	<!--securecookie host="\.yandex\.ru$" name="^(fuid01|yandexuid)$" /-->



    <!--    Rewriting rules.
                -->
	<rule from="^http://www\.yandex\.ru/cycounter(?=$|\?)"
		to="https://yandex.ru/cycounter" />

    <rule from="^http://(?:www\.)?([^.]+)\.yandex\.(net|ru|st)/"
        to="https://$1.yandex.$2/" />

    <rule from="^http://(?:www\.)?yandex\.(net|st)/"
        to="https://yandex.$1/" />

    <rule from="^http://yandex\.ru/"
        to="https://yandex.ru/" />

    <!--
        Here we can enable 4+ level domains with a single regexp,
        but I've never seen any domains more that 4 levels deep
        in Yandex network, so I wouldn't enable them now -
        it may be unconvenient and may broke some services.
        Only 4-level domains match.
                        -->
    <rule from="^http://([^.]+)\.([^.]+)\.yandex\.(net|ru)/"
        to="https://$1.$2.yandex.$3/" />

    <rule from="^http://(?:www\.)?([^.]+)\.ya\.ru/"
        to="https://$1.ya.ru/" />

    <rule from="^http://(?:www\.)?moikrug\.ru/"
        to="https://moikrug.ru/" />

	<rule from="^http://awaps\.yandex\.(com\.au|by|kz)/"
		to="https://awaps.yandex.$1/" />


    <!--    timeout
        Example:    https://market.yandex.ru/search.xml?text=draytek&hid=91083&srnum=233
        List:       https://mail1.eff.org/pipermail/https-everywhere-rules/2012-April/001094.html
                                -->
    <rule from="^https://(cs-ellpic)\.yandex\.net/"
        to="http://$1.yandex.net/" downgrade="1" />

    <!--    "<error><status>401</status><message>Unauthorized</message><cause>Incorrect referer</cause></error>"
        https doesn't give a referrer, so images don't load.
        Example:    https://market.yandex.ru/search.xml?text=draytek&hid=91083&srnum=233
        List:       https://mail1.eff.org/pipermail/https-everywhere-rules/2012-April/001094.html
                                -->
    <!--rule from="^https://static-maps\.yandex\.ru/"
        to="http://static-maps.yandex.ru/" downgrade="1" /-->

</ruleset>