889010 - https://techcrunch.com does not work properly because of mixed content blocking

Status: RESOLVED INVALID

(Tech Evangelism Graveyard :: English US, defect)

Description

[Samvedana (:Samvedana)]

Mixed content blocking is a feature that prevents insecure elements on secure pages from loading. In Firefox 23, this feature will default to blocking "active" insecure content, which may break some web sites. 

More information on Firefox's Mixed Content Blocker is below: 
http://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/

The security feature is currently breaking the HTTPS version of  https://techcrunch.com. 

 https://techcrunch.com should render and function like  http://techcrunch.com, but it doesn't because some HTTP resource(s) are not loaded.  Here is a list of the active, HTTP resources that were blocked: 


Blocked loading mixed active content "http://connect.facebook.net/en_US/all.js?ver=3.6-beta4-24534#xfbml=1" @ https://techcrunch.com/

Blocked loading mixed active content "http://cdn.insights.gravity.com/moth-min.js" @ https://s0.wp.com/_static/??-eJyVjEEOwjAMBD8EMSkCwQHxlta1GkfELYndqr8nSBx6pNIe5jCzsExHFnxZTwVi3dsor2D8I2fscMzkEouL5QB/+Av3A+meQtuubH0cRUkUNFCq1cwTKCphwGyCofn+DLmdWdeaPNPDn683f7rcfRM/V59M5w==:14

Blocked loading mixed active content "http://cdn.insights.gravity.com/moth-min.js" @ https://s0.wp.com/_static/??-eJyVjEEOwjAMBD8EMSkCwQHxlta1GkfELYndqr8nSBx6pNIe5jCzsExHFnxZTwVi3dsor2D8I2fscMzkEouL5QB/+Av3A+meQtuubH0cRUkUNFCq1cwTKCphwGyCofn+DLmdWdeaPNPDn683f7rcfRM/V59M5w==:14

Comment 1

[Matt Wobensmith [:mwobensmith][:matt:]]

Note that this site's SSL cert is incorrect, so in order to see mixed content errors, one would have to allow the bad SSL cert to be used. We consider this to be an error condition that we likely can't prevent, and not an issue with mixed content blocking.

However, if someone would like to tell techcrunch that their site has a bad SSL cert, that is not a bad thing.

Comment 2

[Matt Wobensmith [:mwobensmith][:matt:]]

I'm going to close this bug. Without a valid SSL cert, any mixed content errors we see are not the site's fault, and are not going to be experienced in any normal scenario.