Page MenuHomePhabricator

Firefox search bar not using Secure search
Closed, ResolvedPublic

Description

I'm not sure I am posting at the right place...

I use the https connection mode to frwiki. However, the default search engine which can be identified and added to the list of search engines in Firefox, alongside with duckduckgo, yahoo, etc (sorry, I use the french version of the browser, and can only guess the english names of the functionalities...) only sends results on the http connection mode -not secured.

This means, for example, that I have to manually edit the address bar of my browser to replace http with https.

Would it be possible either to:

  • systematically forcing the search engine to perform a request on https
  • or configuring this search engine addition (I don't know how it works on Firefox) so that when added from https, then it performs search on https and similarly from the http version of the sites?

Thank you!


Version: wmf-deployment
Severity: normal
See Also:
https://bugzilla.mozilla.org/show_bug.cgi?id=758857

Details

Reference
bz45765

Related Objects

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 22 2014, 1:21 AM
bzimport set Reference to bz45765.
bzimport added a subscriber: Unknown Object (MLST).

This is something that has to be done at the Firefox side of things, I remember it was discussed before but was held off because the secure cluster was new and hadn't been put though its paces yet.

Ryan can probably give a better update.

You might be interested in installing https://www.eff.org/https-everywhere - it automatically moves you onto the HTTPS versions of websites as they are available and known about.

In Chrome, going to Tools -> Settings and pressing the Manage Search Engines, you can easily change protocols and links used by specific search engines. I presumed Firefox would have something similar, but at first glance it doesn't. Googling seems to suggest something like https://addons.mozilla.org/en-US/firefox/addon/organize-search-engines/ would allow you to modify them.

@sam Reed : I know these extensions, but I expect this to work out of the box, for the "normal" user.

@p858snake: OK. I had searched the database for this before posting, but couldn't find anything. This is not urgent however. I will wait until I'm sure the request has to be done to Mozilla...

Assuming this is about the Wikimedia search in the Firefox toolbar that you can add by going to "View > Toolbar > Customize > Search" in Firefox, there is nothing that Wikimedia can do as this code is not controlled by Wikimedia (hence closing this report as INVALID as it's out of our control).

Please file a bug report under https://bugzilla.mozilla.org/enter_bug.cgi?product=Firefox&component=Search instead so the Mozilla developers can fix this problem. Thanks in advance!

Well, apparently, according to
https://bugzilla.mozilla.org/show_bug.cgi?id=758857
it seems to be still pending: people at Mozilla are waiting for a "Go!" from Ryan.

Thank you!

cpeterson wrote:

Mozilla's ready when you guys are ready! :)

Nope. I've told them a million times what we're waiting on.

@Ryan, so we are blocking upstream with bug 29898 here ?
I've added that info to this ticket's dependency graph and reopened the ticket. Seems to better represent the state of this problem.

Yes. It was rolled out to the cluster and reverted due to a bug in the implementation.

This is something that needs to be fixed in Mozilla owned code after Wikimedia is ready. It's currently unclear to me what still needs to be done on the Wikimedia side of things so I've asked on the Wikimedia Ops mailing list.

(In reply to Andre Klapper from comment #14)

It's currently unclear to me what needs to be done on the Wikimedia side

In January I asked on the ops mailing list; relevant quotes:

Faidon wrote
"In short: the SSL infrastructure isn't built to scale much right now, hence the worries of uncontrolably increasing the traffic like that. We did have a meeting back in late August which resulted in https://wikitech.wikimedia.org/wiki/HTTPS/Future_work but while some action items have happened since then, we don't have any well-formulated plans/deadlines about moving forward this right now."

About request logs with sourceid=Mozilla-search URL parameter, Christian wrote
"Naive estimate from the sampled 1:1000 log files with a 2014 date (up
to Jan 22, 2014) would be around 700K requests/day. Maximum of weekly pattern is around mid of the week with about 800K requests/day."

Tim wrote "we're a long way from capacity."

And I will close it here as there is nothing code-wise on the Wikimedia site that needs to be done. All work can be followed upstream. :)

Will be fixed in Firefox 35: https://hg.mozilla.org/mozilla-central/rev/612fedcc26e1 (maybe earlier, depends on the flags Mozilla devs set)

cpeterson wrote:

Both Firefox desktop and Android browsers have been updated in Firefox's Nightly 35 channel, which will reach all Firefox users on 2015-01-06:

https://bugzilla.mozilla.org/show_bug.cgi?id=758857#c32

If you don't see any problems on your end, I will try to merge this fix to Firefox's Aurora 34 channel, which would reach all Firefox users sooner, 2014-11-25.