Quoth Alexander Keller:
> > surf is not _silently_ ignoring them. If the validation fails, `sslfailed` will be true and in the window title you can see a `…:U` for untrusted instead of `…:T` for trusted.
>
> You're right. It does provide that feedback. My apologies. :)
It does, but it will still make the connection. I'd rather some
dialog box, so that my session state won't be automatically passed
along to an untrusted server. Not sure the most elegant way to do
this - I suppose one could have a little dmenu prompt asking whether
to continue the connection or cancel it.
> I've just been doing a bunch of digging in the TLS code under `void
> loadstatuschange`. I was prompted because it listed my own domain as
> untrusted. It turns out, if the website is cached and you visit a page
> at https, the page will be marked untrusted. This is because `msg` will
> have no certificate attached. I don't know if this behaviour is
> intentional. You can test this with:
> https://developer.gnome.org/gio/stable/gio-TLS-Overview.html
>
> Load the page, then close surf and open the page again. The first time
> you visit it will be trusted, the second it will be untrusted. It will
> load regardless of your `strictssl` setting. If it is untrusted the
> first time, clear your cache in `~/.surf/cache/` then repeat the
> experiment you should see it.
Good find, thanks, I had been wondering why some sites showed
untrusted seemingly erroneously.
Received on Fri Oct 14 2016 - 12:23:16 CEST