{"thread":{"id":"32755","subject":"[PATCH] remove protocol from gravatar and picon links for clear if Gitweb is being called through a secure server","startedAt":"2013-01-28T19:14:50Z","lastAt":"2013-01-28T23:43:51Z","messageCount":10,"participants":["Andrej Andb","Jonathan Nieder","Junio C Hamano","Андрей Баранов"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"208107","messageId":"1359400490-16449-1-git-send-email-admin@andrej-andb.ru","threadId":"32755","inReplyTo":null,"subject":"[PATCH] remove protocol from gravatar and picon links for clear if Gitweb is being called through a secure server","fromName":"Andrej Andb","fromEmail":"admin@andrej-andb.ru","sentAt":"2013-01-28T19:14:50Z","receivedAt":"2013-01-28T19:14:50Z","isPatch":true,"sender":{"key":"admin@andrej-andb.ru","avatar":"https://gravatar.com/avatar/911e65da5a0561cab1e8ee11c2da0f495d1252ac54ba7eb474cde5a91ade07d5?d=mp&s=160"},"body":"---\n gitweb/gitweb.perl | 4 ++--\n 1 file changed, 2 insertions(+), 2 deletions(-)\n\ndiff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\nindex c6bafe6..1309196 100755\n--- a/gitweb/gitweb.perl\n+++ b/gitweb/gitweb.perl\n@@ -2068,7 +2068,7 @@ sub picon_url {\n \tif (!$avatar_cache{$email}) {\n \t\tmy ($user, $domain) = split('@', $email);\n \t\t$avatar_cache{$email} =\n-\t\t\t\"http://www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n+\t\t\t\"//www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n \t\t\t\"$domain/$user/\" .\n \t\t\t\"users+domains+unknown/up/single\";\n \t}\n@@ -2083,7 +2083,7 @@ sub gravatar_url {\n \tmy $email = lc shift;\n \tmy $size = shift;\n \t$avatar_cache{$email} ||=\n-\t\t\"http://www.gravatar.com/avatar/\" .\n+\t\t\"//www.gravatar.com/avatar/\" .\n \t\t\tDigest::MD5::md5_hex($email) . \"?s=\";\n \treturn $avatar_cache{$email} . $size;\n }\n-- \n1.8.1.1\n"},{"id":"208122","messageId":"20130128205834.GC7759@google.com","threadId":"32755","inReplyTo":"1359400490-16449-1-git-send-email-admin@andrej-andb.ru","subject":"Re: [PATCH] remove protocol from gravatar and picon links for clear if Gitweb is being called through a secure server","fromName":"Jonathan Nieder","fromEmail":"jrnieder@gmail.com","sentAt":"2013-01-28T20:58:34Z","receivedAt":"2013-01-28T20:58:34Z","isPatch":true,"sender":{"key":"jrnieder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/281595?v=4"},"body":"(cc-ing some area experts)\nHi Andrej,\n\nAndrej Andb wrote:\n\n> [Subject: remove protocol from gravatar and picon links for clear if\n> Gitweb is being called through a secure server]\n\nSounds good to me.  May we have your signoff?  (See\nDocumentation/SubmittingPatches for what this means.)\n\nThanks,\nJonathan\n(patch left unsnipped for reference)\n\n> ---\n>  gitweb/gitweb.perl | 4 ++--\n>  1 file changed, 2 insertions(+), 2 deletions(-)\n> \n> diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\n> index c6bafe6..1309196 100755\n> --- a/gitweb/gitweb.perl\n> +++ b/gitweb/gitweb.perl\n> @@ -2068,7 +2068,7 @@ sub picon_url {\n>  \tif (!$avatar_cache{$email}) {\n>  \t\tmy ($user, $domain) = split('@', $email);\n>  \t\t$avatar_cache{$email} =\n> -\t\t\t\"http://www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n> +\t\t\t\"//www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n>  \t\t\t\"$domain/$user/\" .\n>  \t\t\t\"users+domains+unknown/up/single\";\n>  \t}\n> @@ -2083,7 +2083,7 @@ sub gravatar_url {\n>  \tmy $email = lc shift;\n>  \tmy $size = shift;\n>  \t$avatar_cache{$email} ||=\n> -\t\t\"http://www.gravatar.com/avatar/\" .\n> +\t\t\"//www.gravatar.com/avatar/\" .\n>  \t\t\tDigest::MD5::md5_hex($email) . \"?s=\";\n>  \treturn $avatar_cache{$email} . $size;\n>  }\n"},{"id":"208128","messageId":"7vfw1lug6f.fsf@alter.siamese.dyndns.org","threadId":"32755","inReplyTo":"20130128205834.GC7759@google.com","subject":"Re: [PATCH] remove protocol from gravatar and picon links for clear if Gitweb is being called through a secure server","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2013-01-28T21:54:32Z","receivedAt":"2013-01-28T21:54:32Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jonathan Nieder <jrnieder@gmail.com> writes:\n\n> (cc-ing some area experts)\n> Hi Andrej,\n>\n> Andrej Andb wrote:\n>\n>> [Subject: remove protocol from gravatar and picon links for clear if\n>> Gitweb is being called through a secure server]\n>\n> Sounds good to me.  May we have your signoff?  (See\n> Documentation/SubmittingPatches for what this means.)\n>\n> Thanks,\n> Jonathan\n> (patch left unsnipped for reference)\n>\n>> ---\n>>  gitweb/gitweb.perl | 4 ++--\n>>  1 file changed, 2 insertions(+), 2 deletions(-)\n>> \n>> diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\n>> index c6bafe6..1309196 100755\n>> --- a/gitweb/gitweb.perl\n>> +++ b/gitweb/gitweb.perl\n>> @@ -2068,7 +2068,7 @@ sub picon_url {\n>>  \tif (!$avatar_cache{$email}) {\n>>  \t\tmy ($user, $domain) = split('@', $email);\n>>  \t\t$avatar_cache{$email} =\n>> -\t\t\t\"http://www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n>> +\t\t\t\"//www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n\nHrmph.  Is that even a valid URL to refer to that external site from\na https://my.site/some/where/ base URL?  I wouldn't be surprised if\nbrowsers allowed it, but I do not recall seeing such a use in RFCs.\n\nIntuitively it feels strange that the above lets the site that gave\nyou the base URL dictate over what scheme sites unrelated to it has\nto serve their resources.\n"},{"id":"208129","messageId":"7vboc9ufzu.fsf@alter.siamese.dyndns.org","threadId":"32755","inReplyTo":"7vfw1lug6f.fsf@alter.siamese.dyndns.org","subject":"Re: [PATCH] remove protocol from gravatar and picon links for clear if Gitweb is being called through a secure server","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2013-01-28T21:58:29Z","receivedAt":"2013-01-28T21:58:29Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Junio C Hamano <gitster@pobox.com> writes:\n\n>>> -\t\t\t\"http://www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n>>> +\t\t\t\"//www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n>\n> Hrmph.  Is that even a valid URL to refer to that external site from\n> a https://my.site/some/where/ base URL?  I wouldn't be surprised if\n> browsers allowed it, but I do not recall seeing such a use in RFCs.\n\nah, nevermind.  That's net_path in 1808.\n"},{"id":"208130","messageId":"20130128221026.GE7759@google.com","threadId":"32755","inReplyTo":"7vfw1lug6f.fsf@alter.siamese.dyndns.org","subject":"Re: [PATCH] remove protocol from gravatar and picon links for clear if Gitweb is being called through a secure server","fromName":"Jonathan Nieder","fromEmail":"jrnieder@gmail.com","sentAt":"2013-01-28T22:10:26Z","receivedAt":"2013-01-28T22:10:26Z","isPatch":true,"sender":{"key":"jrnieder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/281595?v=4"},"body":"Junio C Hamano wrote:\n>> Andrej Andb wrote:\n\n>>> --- a/gitweb/gitweb.perl\n>>> +++ b/gitweb/gitweb.perl\n>>> @@ -2068,7 +2068,7 @@ sub picon_url {\n>>>  \tif (!$avatar_cache{$email}) {\n>>>  \t\tmy ($user, $domain) = split('@', $email);\n>>>  \t\t$avatar_cache{$email} =\n>>> -\t\t\t\"http://www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n>>> +\t\t\t\"//www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n[...]\n> Intuitively it feels strange that the above lets the site that gave\n> you the base URL dictate over what scheme sites unrelated to it has\n> to serve their resources.\n\nThe main effect is to slightly improve privacy.  A man in the middle\ncan still see the size of avatars and when you fetched them, but at\nleast this way when you are using HTTPS they do not see the names of\nauthors of commits you are looking at.\n\nIt also avoids a mixed content warning.\n\nOn the other hand, it hurts caching by proxies.\n\nJonathan\n"},{"id":"208132","messageId":"7v7gmxuekl.fsf@alter.siamese.dyndns.org","threadId":"32755","inReplyTo":"20130128221026.GE7759@google.com","subject":"Re: [PATCH] remove protocol from gravatar and picon links for clear if Gitweb is being called through a secure server","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2013-01-28T22:29:14Z","receivedAt":"2013-01-28T22:29:14Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jonathan Nieder <jrnieder@gmail.com> writes:\n\n> Junio C Hamano wrote:\n>>> Andrej Andb wrote:\n>\n>>>> --- a/gitweb/gitweb.perl\n>>>> +++ b/gitweb/gitweb.perl\n>>>> @@ -2068,7 +2068,7 @@ sub picon_url {\n>>>>  \tif (!$avatar_cache{$email}) {\n>>>>  \t\tmy ($user, $domain) = split('@', $email);\n>>>>  \t\t$avatar_cache{$email} =\n>>>> -\t\t\t\"http://www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n>>>> +\t\t\t\"//www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n> [...]\n>> Intuitively it feels strange that the above lets the site that gave\n>> you the base URL dictate over what scheme sites unrelated to it has\n>> to serve their resources.\n>\n> The main effect is to slightly improve privacy.  A man in the middle\n> can still see the size of avatars and when you fetched them, but at\n> least this way when you are using HTTPS they do not see the names of\n> authors of commits you are looking at.\n>\n> It also avoids a mixed content warning.\n>\n> On the other hand, it hurts caching by proxies.\n\nI am sure mixed content warning was the primary motivation of the\npatch.  Do we know these external sites actually server what we want\nover https://?\n"},{"id":"208133","messageId":"CAJjU7bQtgaV1XBeeGnuwtz8m3bDtmRYxQE-QasWkoGHNb_NPjQ@mail.gmail.com","threadId":"32755","inReplyTo":"7v7gmxuekl.fsf@alter.siamese.dyndns.org","subject":"Re: [PATCH] remove protocol from gravatar and picon links for clear if Gitweb is being called through a secure server","fromName":"Андрей Баранов","fromEmail":"admin@andrej-andb.ru","sentAt":"2013-01-28T22:33:49Z","receivedAt":"2013-01-28T22:33:49Z","isPatch":true,"sender":{"key":"admin@andrej-andb.ru","avatar":"https://gravatar.com/avatar/911e65da5a0561cab1e8ee11c2da0f495d1252ac54ba7eb474cde5a91ade07d5?d=mp&s=160"},"body":"Or maybe option like:\n/etc/gitweb.conf:\n$feature{'ssl'}{'default'} = ['allways']; ['auto']; ['none'];\n\nbut it's hard for me :) i don't know perl\n\n2013/1/29 Junio C Hamano <gitster@pobox.com>:\n> Jonathan Nieder <jrnieder@gmail.com> writes:\n>\n>> Junio C Hamano wrote:\n>>>> Andrej Andb wrote:\n>>\n>>>>> --- a/gitweb/gitweb.perl\n>>>>> +++ b/gitweb/gitweb.perl\n>>>>> @@ -2068,7 +2068,7 @@ sub picon_url {\n>>>>>    if (!$avatar_cache{$email}) {\n>>>>>            my ($user, $domain) = split('@', $email);\n>>>>>            $avatar_cache{$email} =\n>>>>> -                  \"http://www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n>>>>> +                  \"//www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n>> [...]\n>>> Intuitively it feels strange that the above lets the site that gave\n>>> you the base URL dictate over what scheme sites unrelated to it has\n>>> to serve their resources.\n>>\n>> The main effect is to slightly improve privacy.  A man in the middle\n>> can still see the size of avatars and when you fetched them, but at\n>> least this way when you are using HTTPS they do not see the names of\n>> authors of commits you are looking at.\n>>\n>> It also avoids a mixed content warning.\n>>\n>> On the other hand, it hurts caching by proxies.\n>\n> I am sure mixed content warning was the primary motivation of the\n> patch.  Do we know these external sites actually server what we want\n> over https://?\n>\n"},{"id":"208134","messageId":"20130128223901.GF7759@google.com","threadId":"32755","inReplyTo":"7v7gmxuekl.fsf@alter.siamese.dyndns.org","subject":"Re: [PATCH] remove protocol from gravatar and picon links for clear if Gitweb is being called through a secure server","fromName":"Jonathan Nieder","fromEmail":"jrnieder@gmail.com","sentAt":"2013-01-28T22:39:02Z","receivedAt":"2013-01-28T22:39:02Z","isPatch":true,"sender":{"key":"jrnieder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/281595?v=4"},"body":"Junio C Hamano wrote:\n\n> I am sure mixed content warning was the primary motivation of the\n> patch.\n\nSure, but that's not enough motivation for me to like it. ;-)\nThe privacy aspect is enough to motivate it for me.\n\n>         Do we know these external sites actually server what we want\n> over https://?\n\nYep.  cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi and\nwww.gravatar.com/avatar both support https and return the expected\nresponses for queries over https.\n"},{"id":"208135","messageId":"7v38xkvrbc.fsf@alter.siamese.dyndns.org","threadId":"32755","inReplyTo":"CAJjU7bQtgaV1XBeeGnuwtz8m3bDtmRYxQE-QasWkoGHNb_NPjQ@mail.gmail.com","subject":"Re: [PATCH] remove protocol from gravatar and picon links for clear if Gitweb is being called through a secure server","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2013-01-28T23:08:39Z","receivedAt":"2013-01-28T23:08:39Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Андрей Баранов  <admin@andrej-andb.ru> writes:\n\n> Or maybe option like:\n> /etc/gitweb.conf:\n> $feature{'ssl'}{'default'} = ['allways']; ['auto']; ['none'];\n>\n> but it's hard for me :) i don't know perl\n\nThe effect is the same and your original patch is shorter and\ncleaner to see what is going on; as far as the patch text is\nconcerned, the original one is just fine.\n\nExcept that we wanted a bit more stuff before \"---\" line.  How about\nsomething like this?\n\n        Subject: [PATCH] gitweb: refer to picon/gravatar images over the same scheme\n\n        The images from picon and gravatar are always used over\n        http://, and browsers give mixed contents warning when\n        gitweb is served over https://.\n\n        Just drop the scheme: part from the URL, so that these\n        external sites are accessed over https:// in such a case.\n\n        Signed-off-by: Your Name <your@addre.ss>\n        ---\n         gitweb/gitweb.perl | 4 ++--\n         1 file changed, 2 insertions(+), 2 deletions(-)\n\n        diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\n\t...\n"},{"id":"208137","messageId":"CAJjU7bSF7if6BEuUooW_TOLV0gdA5sCeJqEAeQxfSTMhB+qXEg@mail.gmail.com","threadId":"32755","inReplyTo":"7v38xkvrbc.fsf@alter.siamese.dyndns.org","subject":"Re: [PATCH] remove protocol from gravatar and picon links for clear if Gitweb is being called through a secure server","fromName":"Андрей Баранов","fromEmail":"admin@andrej-andb.ru","sentAt":"2013-01-28T23:43:51Z","receivedAt":"2013-01-28T23:43:51Z","isPatch":true,"sender":{"key":"admin@andrej-andb.ru","avatar":"https://gravatar.com/avatar/911e65da5a0561cab1e8ee11c2da0f495d1252ac54ba7eb474cde5a91ade07d5?d=mp&s=160"},"body":"re sended. Very big thanks for example :D\n\n2013/1/29 Junio C Hamano <gitster@pobox.com>:\n> Андрей Баранов  <admin@andrej-andb.ru> writes:\n>\n>> Or maybe option like:\n>> /etc/gitweb.conf:\n>> $feature{'ssl'}{'default'} = ['allways']; ['auto']; ['none'];\n>>\n>> but it's hard for me :) i don't know perl\n>\n> The effect is the same and your original patch is shorter and\n> cleaner to see what is going on; as far as the patch text is\n> concerned, the original one is just fine.\n>\n> Except that we wanted a bit more stuff before \"---\" line.  How about\n> something like this?\n>\n>         Subject: [PATCH] gitweb: refer to picon/gravatar images over the same scheme\n>\n>         The images from picon and gravatar are always used over\n>         http://, and browsers give mixed contents warning when\n>         gitweb is served over https://.\n>\n>         Just drop the scheme: part from the URL, so that these\n>         external sites are accessed over https:// in such a case.\n>\n>         Signed-off-by: Your Name <your@addre.ss>\n>         ---\n>          gitweb/gitweb.perl | 4 ++--\n>          1 file changed, 2 insertions(+), 2 deletions(-)\n>\n>         diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\n>         ...\n>\n"}]}