1336817 - Flash TV streaming service VOOmotion is broken with security.mixed_content.send_hsts_priming=true

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P1)

Description

[Loic]

Issue reported here:
https://forum.voo.be/voomotion-11/message-derreur-lorsque-desire-regarder-voomotion-sur-mon-ordi-7245
https://forum.voo.be/bienvenue-sur-le-forum-14/voomotion-message-derreur-sur-suite-a-la-mise-a-jour-de-firefox-5101-7291
https://forums.mozfr.org/viewtopic.php?f=5&t=132401

Customers of ISP VOO.be reported the TV streaming service VOOmotion using Flash is broken after the update to Firefox 51.
The issue appears only with FF 32 bits, it works with FF 64 bits.

Error:
Error code #: 102100
Description: Loading of the specified resource has failed.
Runtime Error Code: #43
Runtime Error Message: HTTP_TIME_OUT
Resource URL: http://95.182.209.80/voolinear01-drm/ClubRTL/ClubRTL.m3u8?I=887451d7-91f1-4b62-94c1-b1415fad29dc&K=93&E=20170127182505&A=95.182.138.57&H=B4576E014F95A0C35EB1AB5D8E3F547A

VOO.be is goint to help with guest account to test and debug.

Comment 1

[Benjamin Smedberg]

Loic, you're on point for getting the guest account information? If you need QA assistance for regression ranges please work with :stefang.

Requesting tracking as a regression to get this on relman radar.

Comment 2

[Raphael R]

Hello, 

I'm the engineer working at VOO.be that contacted Abraxas on Geckozone forum.
I can help you for test accounts and debug.

Please PM me to align.

Kind regards,
Raph

Comment 3

[Loic]

(In reply to Raphael R from comment #2)
> Hello, 
> 
> I'm the engineer working at VOO.be that contacted Abraxas on Geckozone forum.
> I can help you for test accounts and debug.
> 
> Please PM me to align.
> 
> Kind regards,
> Raph

Could you send me by email (click on my BMO profile to get my email) the guest account with no georestriction, please. I'll find a regression range.

Comment 4

[Julien Cristau [:jcristau]]

Tracking for 51+.

Comment 5

[Loic]

After some debug with Raphael from VOO.be, it appears the issue is due to the pref security.mixed_content.send_hsts_priming set to true. If the user switches it to false, the player works fine.

By default, it should be false in Release (and Beta) after bug 1335224 pushed by add-on system, but that's not always the case if the user has disabled updates (see https://bugzilla.mozilla.org/show_bug.cgi?id=1335224#c14).

Comment 6

[Andrew Overholt [:overholt]]

(In reply to Loic from comment #5) 
> By default, it should be false in Release (and Beta) after bug 1335224
> pushed by add-on system, but that's not always the case if the user has
> disabled updates (see
> https://bugzilla.mozilla.org/show_bug.cgi?id=1335224#c14).

If the user has updates disabled, would they get any fix we'd make here? Given the fact that this _should_ be false for release and beta users, I'm going to mark this fix-optional for 51 and 52.

Comment 7

[Christoph Kerschbaumer [:ckerschb]]

Kate, can you have a look if that is really a regression? If so, we should try to get it fixed. Otherwise feel free to lower the priority on this one.

Comment 8

[Kate McKinley [:kmckinley, :Kate]]

This was handled by bug 1335224, and should be permanent in the next point release. Leaving open to validate after the point release.

Comment 9

[Nathan Froyd [:froydnj]]

Are we going to disable HSTS priming for 54 as well?

Comment 10

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Nathan Froyd [:froydnj] from comment #9)
> Are we going to disable HSTS priming for 54 as well?

Redirecting to Kate!

Comment 11

[Kate McKinley [:kmckinley, :Kate]]

Priming is still disabled in Beta and Release.

Loic, did you get a test account? If so, can you please verify whether this issue exists on Nightly.

Comment 12

[Loic]

I'll try to test again, but I'm not sure the test account is still available.

Comment 13

[Loic]

It works fine in Nightly with security.mixed_content.send_hsts_priming=true.

Comment 14

[Nathan Froyd [:froydnj]]

Marking disabled for 54, then.

Comment 15

[Kate McKinley [:kmckinley, :Kate]]

Marking as fixed since it works in Nightly and no further reports.