975929 - [MCB] Buttons in the upper-right of Tumblogs don't show with MCB and HTTPS Everywhere

Status: RESOLVED WORKSFORME

(Web Compatibility :: Site Reports, defect)

Description

[AJ Jordan [:strugee] (he/they)]

Steps to Reproduce:
1. Have the Mixed Content Blocker turned on
2. Have HTTPS Everywhere[1] installed and turned on
3. Load any Tumblog, e.g. tumblrbot.tumblr.com
4. Look for the "follow" and "dashboard" buttons at the top-right.

Expected results:
The buttons should display.

Actual results:
The buttons trigger a Mixed Content Blocker violation and never display.

Obviously, this issue is triggered by HTTPS Everywhere. However, eventually Tumblr is probably going to turn on HTTPS by default for these things, and it will break in all browser configurations, not just those with HTTPS Everywhere. Better to fix it now than later.

 [1]: https://www.eff.org/https-everywhere

Comment 1

[AJ Jordan [:strugee] (he/they)]

Looks like Tumblr is going to turn this on quite soon. From https://www.eff.org/deeplinks/2013/11/encrypt-web-report-whos-doing-what:

> Tumblr is planning to upgrade its web connections to HTTPS this year and implement HSTS by 2014

Comment 2

[:Cykesiopka]

Confirming for Aurora 30 with HTTPS Everywhere installed.

Comment 3

[Karl Dubost💡 :karlcow]

I get a blocking for one asset only
Loading mixed (insecure) display content on a secure page "http://38.media.tumblr.com/avatar_35a1a3ec0cf3_64.png"[Learn More]

Which is the avatar.

Comment 4

[Mike Taylor [:miketaylr]]

No MCB errors anymore, and Tumblr is HTTPS by default. Let's close.