openSUSE admin

We would have to serve get-o-o as http instead of https in that case, that won't fly. Otherwise chrome/ium will still block downloads

hellcp wrote:

We would have to serve get-o-o as http instead of https in that case, that won't fly. Otherwise chrome/ium will still block downloads

I was wondering about that, yeah. Is chrome/ium just being unnecessarily strict, or why isn't this a problem in Firefox?

hellcp wrote:

We would have to serve get-o-o as http instead of https in that case, that won't fly. Otherwise chrome/ium will still block downloads

FWIW, I have just tried an http download link from an https site (https://www.jessen.ch) - Chromium did not complain. Version 85.0.4183.121.
I really don't see any reason why a normal clickable http link from an https website should not work? mixing or downgrading happens "behind the scenes", but a direct link ought to be fine.

pjessen wrote:

FWIW, I have just tried an http download link from an https site (https://www.jessen.ch) - Chromium did not complain. Version 85.0.4183.121.
I really don't see any reason why a normal clickable http link from an https website should not work? mixing or downgrading happens "behind the scenes", but a direct link ought to be fine.

Chromium 85, yeah, you will only get a warning https://blog.chromium.org/2020/02/protecting-users-from-insecure.html

Testing with Chromium 88 shows that you cannot download from links with http at all if you are on an https website.

hellcp wrote:

pjessen wrote:

FWIW, I have just tried an http download link from an https site (https://www.jessen.ch) - Chromium did not complain. Version 85.0.4183.121.
I really don't see any reason why a normal clickable http link from an https website should not work? mixing or downgrading happens "behind the scenes", but a direct link ought to be fine.

Chromium 85, yeah, you will only get a warning https://blog.chromium.org/2020/02/protecting-users-from-insecure.html

Testing with Chromium 88 shows that you cannot download from links with http at all if you are on an https website.

Unable to reproduce. I have just installed Chromium 88 on TW and tried the download via my own site (https://www.jessen.ch), no warnings, it just starts the download.

pjessen wrote:

Unable to reproduce. I have just installed Chromium 88 on TW and tried the download via my own site (https://www.jessen.ch), no warnings, it just starts the download.

Mixed Content: The site at 'https://www.jessen.ch/' was loaded over a secure connection, but the file at 'http://ftp.vectranet.pl/opensuse/distribution/leap/15.3/iso/openSUSE-Leap-15.3-NET-x86_64-Build91.1-Media.iso' was redirected through an insecure connection. This file should be served over HTTPS. This download has been blocked. See https://blog.chromium.org/2020/02/protecting-users-from-insecure.html for more details.

I guess it depends on which mirror you end up getting and if it can be upgraded to secure connection? I don't really see how else it could work for you

hellcp wrote:

pjessen wrote:

Unable to reproduce. I have just installed Chromium 88 on TW and tried the download via my own site (https://www.jessen.ch), no warnings, it just starts the download.

Mixed Content: The site at 'https://www.jessen.ch/' was loaded over a secure connection, but the file at 'http://ftp.vectranet.pl/opensuse/distribution/leap/15.3/iso/openSUSE-Leap-15.3-NET-x86_64-Build91.1-Media.iso' was redirected through an insecure connection. This file should be served over HTTPS. This download has been blocked. See https://blog.chromium.org/2020/02/protecting-users-from-insecure.html for more details.

I guess it depends on which mirror you end up getting and if it can be upgraded to secure connection? I don't really see how else it could work for you

Hmm, that is weird - we don't redirect to any https sites - I'll have to check the mirror database if we have any. I have also just tried with Chrome 89, no warnings, no blocks.

I ran another test - there is a 2nd link on https://www.jessen.ch now, an http link to a zip file. No redirections, nothing. With Chromium 85, no problem. Chrome 89 complains about the backlevel TLS support on my server, but that is all.

pjessen wrote:

I ran another test - there is a 2nd link on https://www.jessen.ch now, an http link to a zip file. No redirections, nothing. With Chromium 85, no problem. Chrome 89 complains about the backlevel TLS support on my server, but that is all.

Mixed Content: The site at 'https://www.jessen.ch/' was loaded over a secure connection, but the file at 'http://www.jessen.ch/delia-and-jazz.zip' was redirected through an insecure connection. This file should be served over HTTPS. This download has been blocked. See https://blog.chromium.org/2020/02/protecting-users-from-insecure.html for more details.

Very weird.

When I attempt a download of http://download.opensuse.org/distribution/leap/15.3/iso/openSUSE-Leap-15.3-NET-x86_64-Build91.1-Media.iso, I get two possible mirrors in Switzerland -

http://pkg.adfinis.com/opensuse/distribution/leap/15.3/iso/openSUSE-Leap-15.3-NET-x86_64-Build91.1-Media.iso
http://opensusemirror.lihaso.com/distribution/leap/15.3/iso/openSUSE-Leap-15.3-NET-x86_64-Build91.1-Media.iso

Is this a matter of some setting in Chrome/ium ?

I have put up a very simple page - the server is more current, has TLSv1.2 etc.

https://files.jessen.ch/chrometest

What is funny - my wife confirms the mixed content warning, on Chrome 88 on both Mac and Windows. No download happens, and you have to go look for the warning.
On my Chrome 89 on TW, the download starts, but I see the following in the console when I go look for it:

Mixed Content: The site at 'https://files.jessen.ch/' was loaded over a secure connection, but the file at 'http://pkg.adfinis.com/opensuse/distribution/leap/15.3/iso/openSUSE-Leap-15.3-NET-x86_64-Build91.1-Media.iso' was redirected through an insecure connection. This file should be served over HTTPS. This download will be blocked in future versions of Chrome.

Well, something's screwed up, somewhere. For now I see only one solution, revert get.o.o to use http. (dunno who might be in charge of that)

I just changed the haproxy config - the http -> https redirect is now disabled for get.o.o, so it can also be served over http.

However, Strict-Transport-Security max-age=15768000 means that your browser will remember to use https for get.o.o for about 6 months.