{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/fathom-fox/issues/56","repository_url":"https://api.github.com/repos/mozilla/fathom-fox","labels_url":"https://api.github.com/repos/mozilla/fathom-fox/issues/56/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/fathom-fox/issues/56/comments","events_url":"https://api.github.com/repos/mozilla/fathom-fox/issues/56/events","html_url":"https://github.com/mozilla/fathom-fox/issues/56","id":502852247,"node_id":"MDU6SXNzdWU1MDI4NTIyNDc=","number":56,"title":"Make the HTTPS certificate warning less of a stumbling block","user":{"login":"biancadanforth","id":17437436,"node_id":"MDQ6VXNlcjE3NDM3NDM2","avatar_url":"https://avatars3.githubusercontent.com/u/17437436?v=4","gravatar_id":"","url":"https://api.github.com/users/biancadanforth","html_url":"https://github.com/biancadanforth","followers_url":"https://api.github.com/users/biancadanforth/followers","following_url":"https://api.github.com/users/biancadanforth/following{/other_user}","gists_url":"https://api.github.com/users/biancadanforth/gists{/gist_id}","starred_url":"https://api.github.com/users/biancadanforth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/biancadanforth/subscriptions","organizations_url":"https://api.github.com/users/biancadanforth/orgs","repos_url":"https://api.github.com/users/biancadanforth/repos","events_url":"https://api.github.com/users/biancadanforth/events{/privacy}","received_events_url":"https://api.github.com/users/biancadanforth/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-10-04T21:28:59Z","updated_at":"2019-10-04T23:33:21Z","closed_at":null,"author_association":"COLLABORATOR","body":"In https://github.com/mozilla/fathom/pull/117, @danielhertenstein added a new `fathom-serve` tool that spins up an HTTPS server to serve local frozen sample pages. This is used for FathomFox's Vectorizer among other things.\r\nFor Firefox to load a page from an HTTPS web server, the server has to have a certificate that is trusted. We are currently using a self-signed certificate and asking the developer to trust us by clicking through a warning in Firefox the first time a page is served during that session. Can we add our server certificate to the list of trusted certificates in the temporary profile used by FathomFox?\r\n\r\nHere's the warning displayed currently:\r\n![Screen Shot 2019-10-04 at 1 08 13 PM](https://user-images.githubusercontent.com/17437436/66240241-f3c64280-e6b0-11e9-8cba-afc0aadc6f4c.png)\r\n\r\nI talked to Dana Keeler, a security engineer who works on security certificates, and here's what she suggested:\r\n> the easiest way would probably be to use certutil to add the certificate to the temporary profile's cert9.db as a trust anchor\r\n\r\nHere's a further breakdown of the steps:\r\n1. `brew install nss`\r\n2. Create a Firefox profile directory\r\n3. Use NSS' `certutil` CLI to trust the server certificate in the newly created profile\r\n4. Pass `web-ext run` the path to that profile directory\r\n\r\nAs part of this issue, we should also include a brief explanation in the docs about why we have to use HTTPS in the first place[1], as it is a lot more effort.\r\n\r\n----\r\n\r\n[1]: Why HTTPS rather than HTTP?\r\nUsing the `freeze-dry` library to freeze an HTML page inlines all of its resources, making the HTML file very large--too large to store such files on GitHub.\r\nThis is a problem, because we want to keep these files associated with their Fathom rulesets. After some thinking, we converged on Git LFS as a solution, which lets us store large files elsewhere and keep references to those files in a GitHub repo.\r\nThis required moving the resources out of the HTML document, keeping the HTML document in the GitHub repo, and its resources in Git LFS (@danielhertenstein created the [`fathom-extract` CLI](https://github.com/mozilla/fathom/pull/109) to do this).\r\nBy moving resources outside the page, directories or otherwise, we encountered [CORS restrictions related to how `file:///` URLs are handled](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSRequestNotHttp#Local_File_Security_in_Firefox_68). Basically, when a resource is requested from another file, that's treated as a CORS request, and CORS requests may only use the HTTPS scheme."},"comment":{"url":"https://api.github.com/repos/mozilla/fathom-fox/issues/comments/538591629","html_url":"https://github.com/mozilla/fathom-fox/issues/56#issuecomment-538591629","issue_url":"https://api.github.com/repos/mozilla/fathom-fox/issues/56","id":538591629,"node_id":"MDEyOklzc3VlQ29tbWVudDUzODU5MTYyOQ==","user":{"login":"erikrose","id":295816,"node_id":"MDQ6VXNlcjI5NTgxNg==","avatar_url":"https://avatars3.githubusercontent.com/u/295816?v=4","gravatar_id":"","url":"https://api.github.com/users/erikrose","html_url":"https://github.com/erikrose","followers_url":"https://api.github.com/users/erikrose/followers","following_url":"https://api.github.com/users/erikrose/following{/other_user}","gists_url":"https://api.github.com/users/erikrose/gists{/gist_id}","starred_url":"https://api.github.com/users/erikrose/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erikrose/subscriptions","organizations_url":"https://api.github.com/users/erikrose/orgs","repos_url":"https://api.github.com/users/erikrose/repos","events_url":"https://api.github.com/users/erikrose/events{/privacy}","received_events_url":"https://api.github.com/users/erikrose/received_events","type":"User","site_admin":false},"created_at":"2019-10-04T23:33:21Z","updated_at":"2019-10-04T23:33:21Z","author_association":"MEMBER","body":"Since we chatted on IRC a few hours ago, I recalled that there are several CORS-controlling about:config flags (search for \"cors\" and \"cross\"). It's pretty heavy to start [automatically] installing brew packages. Maybe we can just twiddle those flags more easily?"}}
{"actor":{"display_login":"erikrose"}}