4 ms·
This doesn't mention images specifically -- anyone have insight into how that will work? I'm assuming they're not "active" content. Even Google's image search
by nachteilig 14y ago
This doesn't mention images specifically -- anyone have insight into how that will work? I'm assuming they're not "active" content.
Even Google's image search displays insecure images, so I'd hope they get a pass.
- simonster 14y agoIt looks like images get loaded. However, CSS doesn't, which breaks a lot of sites (e.g. https://www.nytimes.com/ https://www.nytimes.com/). This is in the latest Firefox Nightly build, and available as a pref in older Firefox versions, so you can play with it too.
- nthitz 14y agoJust visited secure NYT link on Chrome 26 and none of the CSS and few images loaded there either. Console reports loads of [blocked] insecure content.
- iaskwhy 14y agoSo that explains why some sites were looking unstyled. Github had the same problem some days ago.
- somesay 14y agoAgain, if you embed non-SSL content into a SSL website, you are obviously doing something wrong. Regex in CSS can be used to guess page content. Also CSS can load SVG which may include JavaScript.
- smackfu 14y agoIt's odd they have a secure version of nytimes.com at all. They have separate subdomains like myaccount.nytimes.com that are secure, and the links back to the homepage are all explicitly http.
- tspiteri 14y agoFrom the article: That means insecure scripts, stylesheets, plug-in contents, inline frames, Web fonts and WebSockets are blocked on secure pages, and a notification is displayed instead. That seems to me like a complete list and does not include images.