bug: Fail on TLS 1.3-only

Question

bug: Fail on TLS 1.3-only

annainfo opened this issue 4 years ago · 7 comments

hanging at https://observatory.mozilla.org/analyze/anna.info while https://www.ssllabs.com/ssltest/analyze.html?d=anna.info returns rating A and "This server supports TLS 1.3."

Answer 1 · 2020-12-14T16:12:42.000Z

This would be resolved by fixing mozilla/http-observatory#394.

Answer 2 · 2020-12-16T14:47:31.000Z

Not sure what "would" entails, but for months it isn't fixed there. So, some warning could be programmed into the website that the observatory is not up-to-date with modern web technology.

Answer 3 · 2020-12-16T15:43:46.000Z

There are no frontend fixes that need to be shipped once the backend is patched in the other issue; closing this repository's duplicate issue as nothing else needs be done in this repository.

Answer 4 · 2020-12-16T16:00:17.000Z

"There are no frontend fixes that need to be shipped once the backend is patched in the other issue;" - there is no need for anything, mozilla.org could close down and planet earth would still fly.

But currently there is a bug in the website and closing the bug report despite being aware of the fact that the bug still exists doesn't fix it.

Answer 5 · 2020-12-16T17:48:59.000Z

The bug is in the scoring engine API, which the website frontend uses, same as any other third party would. While to end users the 'website' may be considered to encompass both GitHub repositories, to those responsible for these repositories, the issue is specific to the scoring engine backend (mozilla/http-observatory) and not to the HTML frontend (mozilla/http-observatory-website).

I see you commenting on this issue in both places, asking us in both places to prioritize your needs While I understand that this is important to you, separating your efforts to pressure a response here diminishes the overall impact of your efforts. Concentrating your feedback in mozilla/http-observatory#394 is the most effective way for you to seek priority.

Answer 6 · 2020-12-17T06:00:18.000Z

The bug is in the scoring engine API, which the website frontend uses

that is untrue

While to end users the 'website' may be considered to encompass both GitHub repositories

what is an "end user" compared with a "user" and why does it matter to this bug report what such an "end user" "may consider"?

to those responsible for these repositories, the issue is specific to the scoring engine backend (mozilla/http-observatory) and not to the HTML frontend (mozilla/http-observatory-website).

where is the source for that a claim?

I see you commenting on this issue in both places, asking us in both places to prioritize your needs

that is untrue

separating your efforts to pressure a response

what do you mean by "to pressure"? I simply reported a bug which is still not fixed, despite you having closed the bug report

here diminishes the overall impact of your efforts.

what diminishes the impact of the bug report with regard to having it fixed is a deceptive closure performed by you

Concentrating your feedback in mozilla/http-observatory#394 is the most effective way for you to seek priority.

That is another bug in another repository.

Answer 7 · 2020-12-17T10:04:14.000Z

to those responsible for these repositories, the issue is specific to the scoring engine backend (mozilla/http-observatory) and not to the HTML frontend (mozilla/http-observatory-website). where is the source for that a claim? The scanner servers we operate here at Mozilla to provide scanning

services to websites are configured in such a way that they do not yet support TLS 1.3-only endpoints. It will not likely require any code updates to either GitHub repository to resolve this issue, as it’s a platform concern rather than a code concern with the Observatory application. The platform configuration is stored in a private repository. If you are an NDA’d Mozillian, please contact me (Atoll) on our internal chat system and I’d be happy to discuss the specifics in more detail with you.