Web extensions are the future

[rugk]

The current plan is that Firefox 57 will only support web extensions. Your add-on is not a web extension yet as far as I can see, so you should consider remaking your add-on. The Firefox 57 release is planned for 28th November 2017.
Already for Firefox 53 (planned release: 18th April 2017) it is planned to no longer accept other new add-on submissions than web extensions on AMO (addons.mozilla.org). Old extensions can however still be updated.
The good message is that one should be able to use your web extensions add-on in all mayor browsers. That's the idea behind web extensions.

Note that all dates are estimates and may be changed.

German source: https://www.soeren-hentzschel.at/firefox/firefox-57-mit-exklusiver-webextension-unterstuetzung/
Original source: https://blog.mozilla.org/addons/2016/11/23/add-ons-in-2017/

[sibiantony]

Hm. Have seen this. Unfortunately I don't have enough time to port/maintain.

Besides, I havn't checked the sslStatus interface etc. I doubt if those are possible with webextensions. It is not allowed for Chrome, so not sure how it is going to be with Firefox.

[rugk]

Besides, I havn't checked if the sslStatus interface etc.

Yep, that's also my fear.

It is not allowed for Chrome, so not sure how is it going to be with Firefox.

At least Firefox plans to implement more APIs in Firefox than Chrome or the webextensions standard.
And of course web extensions are still in development. We should persuade Mozilla to make such ssl/tls things also available and maybe a bit more such as elliptic curves.

Should I open a bugzilla bug?

[sibiantony]

Should I open a bugzilla bug?

If you have some time to spare, yes. Mozilla has this interface called SSLStatus (http://doxygen.db48x.net/mozilla-full/html/da/db2/interfacensISSLStatus.html) and the good working of SSleuth depends on it. ( There are other things like certificate parsing, http observer etc. for which I don't see a problem with Mozilla supporting ). But I'm not sure about SSLStatus. Please do some research before raising the bug. I myself havn't spent enough time on the web extensions documentation.

[rugk]

From a quick research I could not found anything, so I opened a bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1322748

[rugk]

@sibiantony, maybe you want to comment on the BugZilla ticket. See this request:

It would be great to have a concrete list of the specific use-cases and overall aims of add-ons that would use such an API. That way we can design an API that provides something meaningful.

[rugk]

Note that you can use so-called hybrid extensions for switching to Web extensions.

[rugk]

In the bugzilla issue there is much discussion and it seems to go on, but as for this add-on: Do you think you can create a new version until Firefox 57? What are your future plans?

[sibiantony]

I'm following the bug comments, and I can see a ray of hope with EFF's proposal.
If Mozilla does implement this soon enough, I can offer a web extension version to use with Firefox 57+. ( With the minimal functionality without configuration, domains watching etc. all of which can be added eventually. )

However from the current release chart Firefox 57 will be in beta by next month, and I doubt if Mozilla can make it for developer testing.

[ZatsuneNoMokou]

HTTPS Everywhere seems to have a Web Extension on Firefox version now, does it mean at least a part it available for you?

[rugk]

HTTPS Everywhere works in a very different way. It is just about redirecting http to https. This was always available in the WebExtension API in Firefox.
This add-on needs much more. It seems Mozilla devs still discuss implementation/details, so it may still take some Firefox versions. As always, you can vote for the bugzilla ticket or so to make them aware that this issue is of importance to you.

[ZatsuneNoMokou]

Done :)

[ThomasCr]

to bad, that this extension is not compatible to new Firefox Browser. Loved it 🥇

maybe a light version possible?

[qtumbi]

Hi, Sibi and thank you for one of the best extensions on security information for Firefox.
Please (if you can find the time) consider updating as soon as the API will be available.

• all my colleagues (big number) and friends used SSLeuth on my recommendation
• your work is more important than ever in this crazy world!

(the stupid "green safe address-bar" is even worst since you can easily get a free ssl cert and users that will see green will not check anything else...)

Below is the progress on the matter:
https://bugzilla.mozilla.org/show_bug.cgi?id=1322748

[Lew-Rockwell-Fan]

Works great in Pale Moon. In fact, almost everything does. Maybe Mozilla will get it together someday, but the devs there have had a bad attitude for a long time, so I rather doubt it. I seriously doubt I'll ever go back to Firefox.

[rugk]

https://bugzilla.mozilla.org/show_bug.cgi?id=1322748 is already near it's end. So if you, @sibiantony, need another feature there, you'd better ask for it now.

[ZatsuneNoMokou]

We can expect something to be done (and any Firefox version expected?) ?

[rugk]

Good news: The bug has been marked as fixed and will be shipped in Firefox 62 as it seems.

So better start implementation of this add-on now…

[shirishag75]

somebody has asked for an API document but still as when firefox 62 releases, you can get on trying to fix what needs fixing.

[sibiantony]

Yes, good news. API documentation isn't a problem. The details are in the patch.
Firefox 62 is scheduled for 5th of September. I hope to make an initial version available for Beta (July).

[rugk]

Meanwhile, maybe use Liberapay? #86

[rugk]

Firefox 62 will have the new API and it is currently in Beta. https://addons.mozilla.org/en-US/firefox/addon/certainly-something/ is already an add-on for viewing certificate details.

[sibiantony]

Folks, I couldn't spare enough time for this. Things had been keeping me busy. The plan to migrate is still on, but will be slow.

[qtumev]

online privacy/security is important stuff these days so your work is appreciated!
thank you.

[quantumpacket]

Any update on the beta release?

[ghost]

Hi, I love this module with the colors, no update ?

[bugcon]

An alternative and possibly a codebase to work from:
https://addons.mozilla.org/en-GB/firefox/addon/indicatetls/
https://github.com/jannispinter/indicatetls

[llaville]

I used myself alternative suggested by @bugcon since days and I like it !

[sibiantony]

Apologies to the community for the delay. Havn't tried the above addon, but looks good. 'Certainly something' is another good addon I'd recommend. The only difference Ssleuth can offer is the grading.
Once again, sorry folks.

[jannispinter]

Hi there,

I am the developer of IndicateTLS and have just published a new release that resembles the UI of SSLeuth.

I'm looking forward to hear what you think about it.

[dahabakuk]

looks great - i just wish it would integrate into the original green lock on the left side...

[shirishag75]

Hi there,

I am the developer of IndicateTLS and have just published a new release that resembles the UI of SSLeuth.

I'm looking forward to hear what you think about it.

Why is your addon page in german, it seems to default to german I believe ?

https://addons.mozilla.org/de/firefox/addon/indicatetls/

It perhaps would be better served if it the homepage defaulted to english .

also perhaps you could also include the gradation so lesser mortals liks us would know how good the TLS certificate is. Currently it does not :(

[Madis0]

That's just the AMO link in german, try https://addons.mozilla.org/en-US/firefox/addon/indicatetls/

[jannispinter]

i just wish it would integrate into the original green lock on the left side

That is currently impossible to do for a web extension in Firefox.

Why is your addon page in german, it seems to default to german I believe ?

Sorry, I linked the translated page of IndicateTLS on AMO above (it is corrected now). The default is english, you can use the direct link to english here: https://addons.mozilla.org/en-US/firefox/addon/indicatetls/

also perhaps you could also include the gradation

Thanks, that is planned for a future release.

[dddns]

Howdy,

Many thanks for the expiration date implementation, now the extension of PERFECT for me, with just one click i can know/recheck the expiration of the desired website.

Thanks again!

[rugk]

@jannispinter Yeah, very nice!
And FYI: To use language-independent URLs on AMO, just omit the language code, i.e. https://addons.mozilla.org/firefox/addon/indicatetls/

[sibiantony]

@jannispinter nice indeed. Now that SSleuth development is delayed (and possibly won't need anymore), I'll recommend your add-on in the Readme.
Meanwhile, you could take a look in the issues, some of the community requested features - such as identicons for fingerprint, integrating with Firefox padlock identity box etc. Once again, thanks and good work!

[grahamperrin]

👍

https://addons.mozilla.org/addon/indicatetls/ is generic and will redirect according to the user's preference for localised content.

For those of you who have not already found it:

https://github.com/jannispinter/indicatetls

[shirishag75]

+1

https://addons.mozilla.org/addon/indicatetls/ is generic and will redirect according to the user's preference for localised content.

For those of you who have not already found it:

https://github.com/jannispinter/indicatetls

I am using it, however doesn't have a changelog which I submitted as a ticket at jannispinter/indicatetls#25

I have subscribed to most of the tickets, would however be most looking for how secure or unsecure the certificate is etc. The link to test the site against SSL Labs is commendable but it would have been much better if some of the results could be shown within the window itself. Maybe some of the stricter tests.

For e.g. https://www.ssllabs.com/ssltest/analyze.html?d=github.com if I take as an example even seems to have support for weaker cipher suites but not explained why they are there. Also no explanation about what it means for

Session resumption (caching) No (IDs assigned but not accepted)

This again is not explained. It would have been nicer if a layman user could know why the weaker cipher suites still exist (aren't they a possible vulnerability) and similar for session resumption, why is that shown as yellow.

Look forward to explanation.

[grahamperrin]

Classic Add-ons Archive link to legacy version 0.5.3:

• https://ca-archive.biz.tm/storage/479/479492/ssleuth-0.5.3-fx.xpi?origin=GitHub&action=install