-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2012-20274 2012-12-13 05:07:19 --------------------------------------------------------------------------------
Name : mozilla-https-everywhere Product : Fedora 16 Version : 3.1 Release : 1.fc16 URL : https://eff.org/https-everywhere Summary : HTTPS/HSTS enforcement extension for Mozilla Firefox and SeaMonkey Description : HTTPS Everywhere is a Firefox extension produced as a collaboration between The Tor Project and the Electronic Frontier Foundation. It encrypts your communications with a number of major websites.
Many sites on the web offer some limited support for encryption over HTTPS, but make it difficult to use. For instance, they may default to unencrypted HTTP, or fill encrypted pages with links that go back to the unencrypted site.
The HTTPS Everywhere extension fixes these problems by rewriting all requests to these sites to HTTPS.
-------------------------------------------------------------------------------- Update Information:
- Hacky solution to a very nasty bug in which <securecookie> directives would cause cookies to be flagged as secure even if they were set from HTTP origins! https://trac.torproject.org/projects/tor/ticket/7491 https://mail1.eff.org/pipermail/https-everywhere-rules/2012-November/001397.... - Fixes: Akamai, Biomed central, BYU, Cachefly / Topix, DuckDuckGo, Focus.de, Fortum, Mashable, Mail.ru, MayFirst/People Link, MIT, Rackspace, Salsa Labs, SurveyMonkey, Tumblr - Disable: Adtech.de, AllthingsD American Public Media, Dafont, MediaFire, Verizon, vk.com, Wired, Conde Nast - Offer the SSL Observatory popup to a larger cohort of users - Observatory-only translations into Hebrew and Croatian -------------------------------------------------------------------------------- ChangeLog:
* Wed Dec 12 2012 Russell Golden niveusluna@niveusluna.org - 3.1-1 - Hacky solution to a very nasty bug in which <securecookie> directives would cause cookies to be flagged as secure even if they were set from HTTP origins! https://trac.torproject.org/projects/tor/ticket/7491 https://mail1.eff.org/pipermail/https-everywhere-rules/2012-November/001397.... - Fixes: Akamai, Biomed central, BYU, Cachefly / Topix, DuckDuckGo, Focus.de, Fortum, Mashable, Mail.ru, MayFirst/People Link, MIT, Rackspace, Salsa Labs, SurveyMonkey, Tumblr - Disable: Adtech.de, AllthingsD American Public Media, Dafont, MediaFire, Verizon, vk.com, Wired, Conde Nast - Observatory-only translations into Hebrew and Croatian - Offer the SSL Observatory popup to a larger cohort of users * Sat Nov 10 2012 Russell Golden niveusluna@niveusluna.org - 3.0.4-1 - Fixes: -- ACLU, Amazon, Barnes & Noble, CharityNavigator, Cloudfront/Turntable.fm, Coursera, itella.fi, posti.fi, Uservoice https://trac.torproject.org/projects/tor/ticket/7336 https://trac.torproject.org/projects/tor/ticket/7273 https://trac.torproject.org/projects/tor/ticket/7227 - Disable broken: -- Asterisk, Boston Globe (separated out from NYTimes.com), Extabit, Gawker, Google Services (Followers widget), NPR, SF.se, SonyMusic, Statcounter, WebType https://trac.torproject.org/projects/tor/ticket/7270 https://trac.torproject.org/projects/tor/ticket/7243 https://trac.torproject.org/projects/tor/ticket/7361 https://trac.torproject.org/projects/tor/ticket/7120 https://trac.torproject.org/projects/tor/ticket/7278 https://trac.torproject.org/projects/tor/ticket/7363 https://trac.torproject.org/projects/tor/ticket/7294 - No longer cacert: lawblog.de - Offer the SSL Observatory popup to a larger cohort of users - Update translations: Spanish, Russian, Turkish, Swedish * Tue Oct 30 2012 Russell Golden niveusluna@niveusluna.org - 3.0.3-1 - Work around a nasty bug that was affecting some high-volume Live Youtube streams -- (but not other live YouTube streams) -- https://trac.torproject.org/projects/tor/ticket/7127 - Other Fixes: -- AdaCore, Akamai/MTV3 Katsomo, Akamai/HP, Atlassian, Bahn.de, DemocracyNow, MySQL, NuGet, -- PBS, Phronoix Media/Openbenchmarking, SSRN, Spoki -- https://trac.torproject.org/projects/tor/ticket/7219 -- https://trac.torproject.org/projects/tor/ticket/7180 -- https://trac.torproject.org/projects/tor/ticket/7135 -- https://trac.torproject.org/projects/tor/ticket/7206 -- https://trac.torproject.org/projects/tor/ticket/7198 - Disable broken/buggy: -- CBS/Last.fm, Citibank Australia, Bytename, HP, NIFTY, Microchip, MyOpenID, NttDocomo -- https://trac.torproject.org/projects/tor/ticket/6587 -- https://trac.torproject.org/projects/tor/ticket/7226 -- https://trac.torproject.org/projects/tor/ticket/7111 -- https://trac.torproject.org/projects/tor/ticket/7161 -- https://trac.torproject.org/projects/tor/ticket/7114 -- https://trac.torproject.org/projects/tor/ticket/7138 -- https://trac.torproject.org/projects/tor/ticket/7107 - Updated translations: -- Greek, Russian, Latvian - New translation: -- Turkish - Offer the SSL Observatory popup to a larger cohort of users * Sun Oct 21 2012 Russell Golden niveusluna@niveusluna.org - 3.0.2-1 - Some fixes that should have shipped in 3.0.1, but actually didn't: European Southern Observatory, Indeed, LibriVox - New fixes: Microsoft (Bing login button), ZeniMax, Ubuntuone, TrueCrypt, Springer (fix / reenable), Optical Society, IMDB, Facebook, EzineArticles, Broadband Reports, Apache, Akamai (exclude Zynga content to prevent breakage of some Zynga games), Costco * Mon Oct 15 2012 Russell Golden niveusluna@niveusluna.org - 3.0.1-1 - Fixes: adition.com, Akamai/SVTplay.se, Bahn.de, European Southern Observatory, IEEE, Indeed, Java, Librivox, Pinterest, New York Times, Springer, Vimeo, Shannon Health, O'Reilly Media https://trac.torproject.org/projects/tor/ticket/7080 https://mail1.eff.org/pipermail/https-everywhere/2012-October/001583.html https://mail1.eff.org/pipermail/https-everywhere-rules/2012-October/001339.h... https://mail1.eff.org/pipermail/https-everywhere-rules/2012-October/001343.h... - Disable broken: Springer https://mail1.eff.org/pipermail/https-everywhere-rules/2012-October/001340.h... - Updated translations: Basque, Hungarian, Traditional Chinese * Fri Oct 12 2012 Russell Golden niveusluna@niveusluna.org - 3.0.0-2 - Replace "firefox" in EPEL builds with "firefox >= 3.5" for EL users who think updates are for sissies and/or voiding support contracts with proprietary vendors. They can't use this if their Firefox install is older than 3.5 anyway, so what's the harm? * Tue Oct 9 2012 Russell Golden niveusluna@niveusluna.org - 3.0.0-1 - Since version 2.x: - 1,455 new active rulesets - UI improvements: -- right-click to view ruleset source in the config window -- translate some untranslated menus -- better icons in a few places (breaking/redirecting rules, context button) - Numerous improvements to the SSL Observatory internals, including cached submissions on hostile networks, better Tor and Convergence integration, and a new setting to control self-signed cert submission - New translations: Basque, Czech, Danish, French, Greek, Hungarian, Italian, Korean, Malaysian, Polish, Slovak, Turkish, Traditional Chinese - Relative to 3.0development.8: - Only promote the Decentralized SSL Observatory to 5% of non-Tor users - Update the SSL Observatory whitelist of common cert chains - Fixes, mostly in the CDN/media playback department: Akamai/CNN, GO.com/ABC, AWS/Amazon Zeitgeist MP3 player, AWS/Spiegel.tv, Technology Review, Cloudfront/Tunein, Akamai/Discovery Channel, Beyond Security, OCaml, Gentoo, Nokia, Widgetbox.com, Squarespace https://trac.torproject.org/projects/tor/ticket/4199 https://trac.torproject.org/projects/tor/ticket/6871 https://trac.torproject.org/projects/tor/ticket/6992 https://trac.torproject.org/projects/tor/ticket/7000 https://trac.torproject.org/projects/tor/ticket/7020 https://mail1.eff.org/pipermail/https-everywhere-rules/2012-October/001324.h... - Disable buggy: Web.de, AJC.com, Feross, Bestofmedia - Remove a lot of off-by-default rulesets from the code, since they have some costs in terms of startup speed and RAM usage * Thu Sep 27 2012 Russell Golden niveusluna@niveusluna.org - 2.2.3-1 - Workaround for breakage in Amazon Look Inside the Book (via Cloudfront) -- https://trac.torproject.org/projects/tor/ticket/6848 - Fix logout for AOL users - Other fixes: PassThePopcorn, WhatCD, Antispam.de, RFCeditor, -- Weatherspark / GoogleMaps - Disable broken: SVT.se * Thu Sep 6 2012 Russell Golden niveusluna@niveusluna.org - 2.2.2-1 - Fix a bug that was preventing settings from persisting: https://trac.torproject.org/projects/tor/ticket/6653 - Fixes and improvements: Lenovo, YahooNew, Pirate Party, OpenDNS, Wordpress https://trac.torproject.org/projects/tor/ticket/6604 https://mail1.eff.org/pipermail/https-everywhere-rules/2012-August/001267.ht... - Disable broken rulesets: FAZ, Playboy, Mapquest, Imgur, F-Secure * Fri Aug 17 2012 Russell Golden niveusluna@niveusluna.org - 2.2.1-1 - Update to upstream 2.2.1. Hopefully this one will actually work. * Fri Aug 17 2012 Russell Golden niveusluna@niveusluna.org - 2.1-5 - Add appManaged flag to prevent update in user profile directories - prompted by release of badly broken 2.2 upstream * Fri Aug 17 2012 Russell Golden niveusluna@niveusluna.org - 2.2-2 - Prevent ruleset bugs from crashing the UI -- https://trac.torproject.org/projects/tor/ticket/6280 - Fix the enable/disable button in Firefox 14 -- https://trac.torproject.org/projects/tor/ticket/6212 - Fix a nasty bug in the optional "Search www.google.com" ruleset: -- https://gitweb.torproject.org/https-everywhere.git/commitdiff/50ca41a1e189ef... - Disable buggy/broken: ZDNet, Globe and Mail, Blip.tv, Governo Portugês, -- Alton Towers, McAfee :( :( :( - Fixes: Yandex, Wikipedia, PirateParty, JBoss, Gentoo - Hopefully the last 2.x release before 3.0 stable * Fri Jul 20 2012 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 2.1-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild * Mon Jul 2 2012 Russell Golden niveusluna@niveusluna.org - 2.1-3 - Change Requires to require firefox on all RHEL versions * Sun Jun 24 2012 Russell Golden niveusluna@niveusluna.org - 2.1-2 - Fix context menu breakage when URIs lack a host - Fixes: CiteULike, MozillaMessaging, Yandex, Demonoid, Pirate Party, -- Gentoo, NYTimes, Microsoft, Wikipedia, Lenovo -- https://mail1.eff.org/pipermail/https-everywhere-rules/2012-June/001189.html -- https://trac.torproject.org/projects/tor/ticket/6091 -- https://mail1.eff.org/pipermail/https-everywhere-rules/2012-June/001190.html -- https://mail1.eff.org/pipermail/https-everywhere-rules/2012-May/001186.html -- https://mail1.eff.org/pipermail/https-everywhere/2012-May/001433.html - Disable broken: MarketWatch, Disqus, Magento, Lavasoft, Project Syndicate, -- Typepad/Say Media -- https://trac.torproject.org/projects/tor/ticket/5899 -- https://trac.torproject.org/projects/tor/ticket/5496 * Tue May 1 2012 Russell Golden niveusluna@niveusluna.org - 2.0.3-2 - Add file that I missed in the last build. * Sat Apr 28 2012 Russell Golden niveusluna@niveusluna.org - 2.0.3-1 - Fix a downgrade attack that might allow attackers to deny HTTPS Everywhere protection for cookies on some domains. https://trac.torproject.org/projects/tor/ticket/5676 - Minor redirection mechanism fixes - Fixes: WordPress, Yandex, OpenDNS, Via.me/AWS - Improvements: Mozilla - Disable broken: ReadWriteWeb * Fri Apr 20 2012 Russell Golden niveusluna@niveusluna.org - 2.0.2-1 - Fix a weird wrong DOM-origin bug that occurred while redirects were in -- progress (this might have security implications, although we are unsure -- if it was exploitable). -- https://trac.torproject.org/projects/tor/ticket/5477 - By default, use https://google.co.cctld instead of -- encrypted.google.com - Add an optional ruleset to use https://www.google.com -- instead of encrypted.google.com, too - Ruleset fixes: Debian, Kohls, Malwarebytes, Yandex, Wikipedia, Mises.org, -- OpenDNS, Wizards of the Coast, Lenovo, Barnes and Noble -- https://trac.torproject.org/projects/tor/ticket/5509 -- https://trac.torproject.org/projects/tor/ticket/5491 -- https://trac.torproject.org/projects/tor/ticket/5303 - Stumble across more horrible security holes in the Verizon website: -- https://mail1.eff.org/pipermail/https-everywhere-rules/2012-February/001003.... - Disable the Gentoo ruleset on non-CAcert platforms - Disable buggy rulesets: IBM, Scribd, Wunderground :( :( :( -- https://trac.torproject.org/projects/tor/ticket/5344 -- https://trac.torproject.org/projects/tor/ticket/5435 -- https://trac.torproject.org/projects/tor/ticket/5630 * Wed Feb 29 2012 Russell Golden niveusluna@niveusluna.org - 2.0.1-1 - Sync to upstream 2.0.x branch - Too many changes to all list here. None affect the end user experience. Being a Mozilla extension, it'll auto-update anyway. * Wed Jan 11 2012 Russell Golden niveusluna@niveusluna.org - 1.2.2-1 - Google Cache is back! - Fixes: Wikipedia, Identi.ca, Verizon, CCC.de, UserScripts, Yandex - Improvements: EFF - Disable broken: NSF.gov, WHO.int * Wed Nov 16 2011 Russell Golden niveusluna@niveusluna.org - 1.2.1-1 - Google Cache is broken, remove it from GoogleServices :( :( :( - Fix for the Google Image Search homepage - Exclude help.duckduckgo.com: -- https://trac.torproject.org/projects/tor/ticket/4399 - Disable Yahoo! Mail: -- https://trac.torproject.org/projects/tor/ticket/4441 - Installable on Firefox 10 * Tue Nov 15 2011 Russell Golden niveusluna@niveusluna.org - 1.2-1 - Fixes: WordPress, Statcounter, Java, Bahn.de, SICS.se - Improvements: use fancy new HTTPS Wikipedia - Disable broken: OpenUniversity, TV.com, Random.org, kb.CERT * Thu Oct 20 2011 Russell Golden niveusluna@niveusluna.org - 1.1-1 - Further tweaks to internals, will hopefully fix a number of weird issues: -- https://trac.torproject.org/projects/tor/ticket/4194 -- https://trac.torproject.org/projects/tor/ticket/4149 -- https://mail1.eff.org/pipermail/https-everywhere/2011-October/001208.html - YouTube is enabled by default! - Fixes: Yandex, Statcounter, Polldaddy, SBB.ch - Improvements: Facebook+ - Disable broken: Bloglines, EPEAT --------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use su -c 'yum update mozilla-https-everywhere' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------
package-announce@lists.fedoraproject.org