Closed Bug 1077891 Opened 5 years ago Closed 5 years ago
HSTS preload update removed everything, because the update script is broken
https://hg.mozilla.org/mozilla-central/rev/b3fb5bdc588c Prolly should have written those bug 905852 tests, somehow, or set up that cronjob to run it Friday afternoon and mail the results to you, or added code to make it abort if a sanity-check hits an unexpected error, or to make it abort if it's going to remove everything.
This looks like a regression from the extra parameter added in https://hg.mozilla.org/mozilla-central/rev/aeacfe204b8d . [Tracking Requested - why for this release]: I'm not sure how bad this is; hoping somebody else can comment.
I forgot that this script uses nsISiteSecurityService to parse HSTS headers when we updated the interface for HPKP. Note that the situation is not as bad as the summary indicates. Due to the mechanism that doesn't remove sites from the list unless we can connect to them and see that they either don't send the header anymore or send it with max-age:0, no hosts that still send the header were actually removed from the list as a result of this failure (robteix.com was removed because it doesn't send the header, as far as I can see).
Assignee: nobody → dkeeler
Status: NEW → ASSIGNED
Attachment #8500586 - Flags: review?(mmc)
Attachment #8500586 - Flags: review?(mmc) → review+
You need to log in before you can comment on or make changes to this bug.