900440 - krebsonsecurity.com has active mixed content (JS and CSS) that are blocked by the mixed content blocker

Status: RESOLVED WORKSFORME

(Web Compatibility :: Site Reports, defect)

Description

[Stefan Baebler]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0 (Beta/Release)
Build ID: 20130729175331

Steps to reproduce:

Visited https://krebsonsecurity.com/ with FireFox 23 (currently in beta)


Actual results:

Some JavaScript and CSS resources fail to load, with console erro:
Blocked loading mixed active content "http://krebsonsecurity.com/wp-content/plugins/jspullquotes/resources/jspullquotes-core.css"
Blocked loading mixed active content "http://krebsonsecurity.com/wp-content/plugins/jspullquotes/resources/jspullquotes-default.css"
Blocked loading mixed active content "http://krebsonsecurity.com/wp-content/plugins/jspullquotes/resources/jspullquotes.js"


Expected results:

These resources should be loaded via https 
(either by fixing the references on the site, or resolving Bug 776278)

Comment 1

[Tanvi Vyas[:tanvi]]

This is a security blog site.

Also blocked on chrome, and most probably on IE (because its javascript and css).  Matt, can you check IE when you have a chance?

Comment 2

[:Cykesiopka]

https://krebsonsecurity.com is blocked on IE(10) for me as well, so confirming for now...

Comment 3

[Karl Dubost💡 :karlcow]

He has a twitter account but he's not replying to people
https://twitter.com/briankrebs/

His site is powered by WordPress.
In the inspector searching with
img[src^=http\:]

You can notice that it's often about images in his blog posts. Example

<a href="http://krebsonsecurity.com/wp-content/uploads/2013/04/robotrobkb.jpg"><img class="alignright size-medium wp-image-19914" src="http://krebsonsecurity.com/wp-content/uploads/2013/04/robotrobkb-285x213.jpg" alt="robotrobkb" width="285" height="213"></a>

I do not think he is typing the link markup by hand. I suspect WordPress does. 

He is using
<meta name="generator" content="WordPress 4.0" />
which is the latest version.

I wonder if this is fixing the issue.
https://wordpress.org/plugins/ssl-insecure-content-fixer/

And WordPress community has a lot of issues related to Mixed Content Blocking
https://wordpress.org/search/mixed+content+blocking

Comment 4

[Karl Dubost💡 :karlcow]

Contacted http://twitter.com/MozWebCompat/status/516821761879330816
but not sure he will look at it.

Comment 5

[Mike Taylor [:miketaylr]]

Not seeing any MCB errors anymore.