From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?UTF-8?Q?Court=C3=A8s?=) Subject: bug#22972: insecure content on: https://gnu.org/software/guix/packages/ Date: Fri, 25 Mar 2016 13:35:17 +0100 Message-ID: <87k2kqpwfu.fsf@gnu.org> References: <20160310001030.GA24372@protected.rcdrun.com> <87zitnt108.fsf@gnu.org> <20160325094356.GK5051@protected.rcdrun.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:54414) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ajQyD-0007mC-6W for bug-guix@gnu.org; Fri, 25 Mar 2016 08:36:06 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ajQyA-0003er-04 for bug-guix@gnu.org; Fri, 25 Mar 2016 08:36:05 -0400 Received: from debbugs.gnu.org ([208.118.235.43]:39852) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ajQy9-0003en-Sk for bug-guix@gnu.org; Fri, 25 Mar 2016 08:36:01 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1ajQy9-0000pw-OT for bug-guix@gnu.org; Fri, 25 Mar 2016 08:36:01 -0400 Sender: "Debbugs-submit" Resent-Message-ID: In-Reply-To: <20160325094356.GK5051@protected.rcdrun.com> (Jean Louis's message of "Fri, 25 Mar 2016 10:43:56 +0100") List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org To: Jean Louis Cc: 22972@debbugs.gnu.org Jean Louis skribis: > The content is insecure as shown by Icecat. IceCat doesn=E2=80=99t =E2=80=9Cshow=E2=80=9D me this. What are you referr= ing to? > That happens because either scripts are included (did not check it) > which are with http:// or images (I did check it). Right, project logos come from different places, and not necessarily https. I understand that this can be a problem. However, at least for now, we don=E2=80=99t copy those logos to www.gnu.org, so it seems there=E2= =80=99s not much we can do. > Small remark to the page with packages: it is in few lines, > which makes editing, even with Emacs harder. There shall be new lines or > indenting after > or after each package. Otherwise it makes editing the > HTML very hard (I know there is source, but looking inside of HTML is > difficult). As you write, this is not meant to be edited, so=E2=80=A6 :-) > The package descriptions shall not be opened by Javascript but on the > long run, each package shall get its own page, and of course there shall > be search engine, just like with Debian. This all becomes totally easy > with guix being Guile module, and exciting. Yes, definitely. Dave=E2=80=99s guix-web=C2=B9 does that and more. I thin= k we should consider running it with actions disabled (i.e., no installing/removing/upgrading), probably behind nginx to cache things a bit. Any takers? Thanks, Ludo=E2=80=99. =C2=B9 https://git.dthompson.us/guix-web.git