Skip to content or view screen version

Always use secure connection to UK Indymedia sites - Firefox add-on

Rogue Radish | 07.09.2010 16:42 | Indymedia | Technology

Here's how you can set Firefox to always use secure (encrypted) connections on UK Indymedia sites.

Indymedia recommend that you connect to sites using a secure connection. This means connecting to:
 https://www.indymedia.org.uk/en/
Instead of
 http://www.indymedia.org.uk/en/
(i.e. https at the beginning instead of http)

You can read about why to do this and what a secure connection is here (also contains useful information about accepting certificates):  https://www.indymedia.org.uk/en/static/security.html

If you use the Firefox browser (  http://www.mozilla-europe.org/en/firefox/ ), those lovely people at The Tor Project (  https://www.torproject.org/ ) and the Electronic Frontier Foundation (  https://eff.org/ ) have written an add-on that allows you to default to the secure connection for websites called HTTPS Everywhere. This means that even if you type  http://www.indymedia.org.uk/en/ you will be taken to the secure version of the site.

The add-on does not, by default, include rules for UK Indymedia sites. So I thought I'd write some. So, if you want to make sure that when you browse Indymedia sites based in the UK, here is how to do it.

1. Install the add-on. You can get the add-on from EFF here:  https://www.eff.org/https-everywhere

2. Add the UK Indymedia sites rule to the add-on by copying the attached file into the HTTPSAnywhere subdirectory of your Firefox profile (help on finding your profile:  http://kb.mozillazine.org/Profile_folder_-_Firefox )

3. Restart Firefox. Make sure that the HTTPSAnywhere add-on is enabled and that the 'UK Indymedias' box is checked in the preferences. If you need to change the preferences, restart Firefox again.

4. Check that it is working. This link:  http://oxford.indymedia.org.uk should take you to this address:  https://www.indymedia.org.uk/en/regions/oxford/

NOTES

a. If you spot anything that is not working, or if I have missed off any sites, please say so in the comments and I will update the script.

b. I am not a techie, and I think there might be a better way of writing the rules. If you can do so, please add it to the comments. The instructions for writing rules are here:  https://www.eff.org/https-everywhere/rulesets

c. The xml file is provided as is. I've tried to make sure it works, but use of the rules is at your own risk.


Hope this helps. Happy IMC surfing.

Rogue Radish

Additions

comprehensive ruleset for all international Indymedia sites

09.09.2010 01:15

I've spent several hours checking all Indymedia sites linked from the front page to see if they accept encrypted URLs, and here is the resulting ruleset for use with HTTPS Everywhere. Let me know if you find something that isn't covered by this, or that doesn't work.

<ruleset name="Indymedia">

<!-- the main indymedia.org and indymedia.org.uk domains -->
<rule from="^http://(www\.)?indymedia\.org(\.uk)?" to=" https://www.indymedia.org$2"/>
<!-- london.indymedia.org.uk is different to indymedia.org.uk/en/regions/london/ -->
<rule from="^http://(www\.)?london\.indymedia\.org\.uk" to=" https://london.indymedia.org.uk"/>
<!-- Nottingham has its own setup -->
<rule from="^http://(www\.)?nott(ingham|s)\.indymedia\.org\.uk" to=" https://nottingham.indymedia.org.uk"/>
<!-- Bristol has its own setup under the indymedia.org domain -->
<rule from="^http://(www\.)?bristol\.indymedia\.org" to=" https://bristol.indymedia.org"/>
<!-- All other UK regions are in region subdirectories of the main indymedia.org.uk domain -->
<rule from="^http://(www\.)?(birmingham|cambridge|liverpool|manchester|oxford|scotland|sheffield|southcoast|world)\.indymedia\.org\.uk"
to=" https://www.indymedia.org.uk/en/regions/$2"/>
<!-- Scotland has its own domain as well now, indymediascotland.org, but that doesn't have an encrypted URL -->
<!-- Northern Indymedia has its own domain -->
<rule from="^http://(www\.)?(northern-|northern.)indymedia\.org" to=" https://northern.indymedia.org"/>

<!-- The print and satellite projects aren't encrypted, but radio and video are -->
<rule from="^http://(www\.)?(radio|video)\.indymedia\.org" to="https://$2.indymedia.org"/>

<!-- Some international Indymedias have encrypted sites, others don't.
Many of them have self-signed or invalid certificates, so your browser might complain, but you can override it. -->

<!-- Africa -->
<rule from="^http://(www\.)?(estrecho|kenya|southafrica)\.indymedia\.org" to="https://$2.indymedia.org"/>

<!-- Canada -->
<rule from="^http://(www\.)?(maritimes|bc)\.indymedia\.org" to="https://$2.indymedia.org"/>

<!-- East Asia -->
<rule from="^http://(www\.)?(qc)\.indymedia\.org" to="https://$2.indymedia.org"/>
<!-- Europe -->
<rule from="^http://(www\.)?(abruzzo|athens|austria|barcelona|belarus|bxl|brussels|calabria|emiliaromagna|euskalherria|grenoble|istanbul|italy|linksunten|madrid|malta|nantes|ovl|paris|piemonte|roma|switzerland|torun|toscana|ukraine)\.indymedia\.org"
to="https://$2.indymedia.org"/>
<rule from="^http://(www\.)?indymedia.ie" to=" https://www.indymedia.ie"/>
<rule from="^http://(www\.)?indymedia.nl" to=" https://www.indymedia.nl"/>

<!-- Latin America -->
<rule from="^http://(www\.)?(argentina|bolivia|sucre|colombia|ecuador|peru|qollasuyu|rosario|santiago|uruguay|venezuela)\.indymedia\.org"
to="https://$2.indymedia.org"/>

<!-- Oceania -->
<!-- nothing yet -->

<!-- South Asia -->
<!-- nothing yet -->

<!-- United States -->
<rule from="^http://(www\.)?(arizona|hawaii|houston|sandiego|seattle|)\.indymedia\.org"
to="https://$2.indymedia.org"/>
<rule from="^http://(www\.)?.indybay\.org" to=" https://www.indybay.org"/>

<!-- West Asia -->
<rule from="^http://(www\.)?(israel)\.indymedia\.org" to="https://$2.indymedia.org"/>

<!-- Topics -->
<rule from="^http://(www\.)?(biotech)\.indymedia\.org" to="https://$2.indymedia.org"/>

<!-- Process -->
<!-- Ironically, tech.indymedia.org doesn't have a https site -->
<rule from="^http://(www\.)?(lists|docs)\.indymedia\.org" to="https://$2.indymedia.org"/>

</ruleset>


anon


@ comprehensive ruleset for all international Indymedia sites

09.09.2010 18:31

Nice one anon - works for me.

I put the script on my blog here so that people can see and copy it without the space that gets added when this site turns URLs into like (like this to=" https://london.indymedia.org.uk )

Here's the script without spaces ...
 http://penguin.ox4.org/node/397

When fully tested it, I think it's worth sending to EFF to include as a standard part of HTTP Everywhere.

penguin


Comments

Hide the following 11 comments

Here's the attachment

07.09.2010 17:01

Whoops, something went wrong. Hopefully here's the attachment

Radish


Here's the attachment

07.09.2010 17:22

Seems you can't upload .xml files. Here's the attachment as a .txt file. You will need to rename it to UK.Indymedia.xml before saving it in your profile page.

Radish


INDYMEDIA MODS CAN YOU HELP?

07.09.2010 17:29

Seems I can't upload the file in either xml ot txt format. I ftp'ed both formats and attached them to my comments but they seems to have vanished. And I can't paste the xml into the body of the article. The article is useless without the file. Can you either find a way of posting the file or delete the article (which would be a shame as I thought it was a useful tool).

Cheers

Radish


what to do

07.09.2010 22:20

after downloading installing firefox and https everywhere;


copy paste all the below code into a notepad and save the file as "indymedia https":






open up a folder and click

1. "Tools", and select "Folder Options"
2. click the "view" tab & make sure the "hide extensions for known file types" is NOT ticked.
3. change your saved notepad with the above text from "indymedia https.txt" to "indymedia https.xml"
4. put that file into the firefox, https add on folder that can be located following the instructions on this page:  http://kb.mozillazine.org/Profile_folder_-_Firefox

for windows click here:  http://kb.mozillazine.org/Profile_folder_-_Firefox#Windows

example:

On Windows 2000, Windows XP, Windows Vista, and Windows 7

1. Press "Windows key Image:Windows_Key.png + R" to open the Run box
(or, you can click "Start → Run..." on Windows 2000/XP)
2. In the Run box, type in %APPDATA%
3. Click OK. A Windows Explorer window will appear.
4. In this window, choose Mozilla → Firefox → Profiles.

then keep clicking through the folders until you come to the add-ons folder and simply move the xml (txt) file into the https folder.

NB. remember to recheck "Folder Options", "view", "hide extensions for known file types" as if you change the name and lose the extension the pc will not know how to open the apps/docs, etc!

good luck and hope this helps.

help


Error message in browser

07.09.2010 22:31


"www.indymedia.org.uk uses an invalid security certificate"

Could someone please make sure that the certificate is valid? Thanks...


invalid


re: invalid security certificate

07.09.2010 23:12

The security certificate isn't really invalid, it's just your browser can't vouch for its authenticity.

Indymedia sends you its encryption key so that the web traffic can be encrypted, so how do you know it is genuine and hasn't been tampered with en route by an evil government and replaced with a bogus encryption key?

Basically the keys can be digitally signed by a trusted authority who confirms they are genuine. Browsers come pre-loaded with a few key-signing authorities, and you just have to trust they are OK. But if Indymedia's keys aren't signed by any of the authorities contained in your browser, it can't confirm the encryption key is genuine.

In Firefox you can click on the padlock icon at the lower right to see the certificate details. In Indymedia's case it appears to be signed by cacert.org

If your browser doesn't have cacert.org as a trusted authority then it will give warning messages when visiting the indymedia website with a https:// URL.

anon


howto for Linux users

07.09.2010 23:28

This works for me using Linux:

go to ~/.mozilla/firefox/dftghdfgh.default/HTTPSEverywhereUserRules/
(the exact name before .default will vary)

create a text file here called indymedia.xml and put this in it (hopefully Indymedia won't mangle or remove this):

<ruleset name="Indymedia">
<rule from="^http://([^/:@]*)\.indymedia\.org\.uk" to="https://$1.indymedia.org.uk"/>
</ruleset>

restart Firefox.

Now it should work for Indymedia. Under Tools/Add-ons/HTTPS-Everywhere/Preferences you should see Indymedia listed.

Hopefully this process will become easier in time.

anon


The full xml file

08.09.2010 15:59

Here's the full xml file I originally tried to post.

@ howto for Linux users
I like your use of regular expressions (they're beyond me), but I don't think that your script will cover every circumstance. For example:
Bristol - use the address ***.org (not ***.org.uk)
Many others use  http://www.indymedia.org.uk/en/regions/[region]

Hence I came up with the very verbose xml below that (AFAIK) covers all the bases. I'm sure that somebody more techie than me could shorten this by using regular expressions.

BTW - Indymedia seems to strip code pasted in comments and articles. Probably a very sensible security function. The way to post opening and closing tags (< and >) is to use html entities. So use &.lt; for < and &.gt; for > (without the dot in both cases).


See comment 'what to do' for how to use this on Windows and 'howto for Linux users' on how to use this on Linux.


<ruleset name="UK Indymedias">
<rule from="^ http://indymedia.org.uk" to=" https://www.indymedia.org.uk"/>
<rule from="^ http://www.indymedia.org.uk" to=" https://www.indymedia.org.uk"/>
<rule from="^ http://indymedia.org.uk/en/regions/birmingham" to=" https://www.indymedia.org.uk/en/regions/birmingham"/>
<rule from="^ http://www.indymedia.org.uk/en/regions/birmingham" to=" https://www.indymedia.org.uk/en/regions/birmingham"/>
<rule from="^ http://www.birmingham.indymedia.org.uk" to=" https://www.indymedia.org.uk/en/regions/birmingham"/>
<rule from="^ http://birmingham.indymedia.org.uk" to=" https://www.indymedia.org.uk/en/regions/birmingham"/>
<rule from="^ http://bristol.indymedia.org" to=" https://bristol.indymedia.org"/>
<rule from="^ http://www.bristol.indymedia.org" to=" https://bristol.indymedia.org"/>
<rule from="^ http://indymedia.org.uk/en/regions/cambridge" to=" https://www.indymedia.org.uk/en/regions/cambridge"/>
<rule from="^ http://www.indymedia.org.uk/en/regions/cambridge" to=" https://www.indymedia.org.uk/en/regions/cambridge"/>
<rule from="^ http://www.cambridge.indymedia.org.uk" to=" https://www.indymedia.org.uk/en/regions/cambridge"/>
<rule from="^ http://cambridge.indymedia.org.uk" to=" https://www.indymedia.org.uk/en/regions/cambridge"/>
<rule from="^ http://indymedia.org.uk/en/regions/oxford" to=" https://www.indymedia.org.uk/en/regions/oxford"/>
<rule from="^ http://www.indymedia.org.uk/en/regions/oxford" to=" https://www.indymedia.org.uk/en/regions/oxford"/>
<rule from="^ http://www.oxford.indymedia.org.uk" to=" https://www.indymedia.org.uk/en/regions/oxford"/>
<rule from="^ http://oxford.indymedia.org.uk" to=" https://www.indymedia.org.uk/en/regions/oxford"/>
<rule from="^ http://indymedia.org.uk/en/regions/liverpool" to=" https://www.indymedia.org.uk/en/regions/liverpool"/>
<rule from="^ http://www.indymedia.org.uk/en/regions/liverpool" to=" https://www.indymedia.org.uk/en/regions/liverpool"/>
<rule from="^ http://www.liverpool.indymedia.org.uk" to=" https://www.indymedia.org.uk/en/regions/liverpool"/>
<rule from="^ http://liverpool.indymedia.org.uk" to=" https://www.indymedia.org.uk/en/regions/liverpool"/>
<rule from="^ http://london.indymedia.org.uk" to=" https://london.indymedia.org.uk"/>
<rule from="^ http://www.london.indymedia.org.uk" to=" https://london.indymedia.org.uk"/>
<rule from="^ http://indymedia.org.uk/en/regions/london" to=" https://www.indymedia.org.uk/en/regions/london"/>
<rule from="^ http://www.indymedia.org.uk/en/regions/london" to=" https://www.indymedia.org.uk/en/regions/london"/>
<rule from="^ http://indymedia.org.uk/en/regions/manchester" to=" https://www.indymedia.org.uk/en/regions/manchester"/>
<rule from="^ http://www.indymedia.org.uk/en/regions/manchester" to=" https://www.indymedia.org.uk/en/regions/manchester"/>
<rule from="^ http://www.manchester.indymedia.org.uk" to=" https://www.indymedia.org.uk/en/regions/manchester"/>
<rule from="^ http://manchester.indymedia.org.uk" to=" https://www.indymedia.org.uk/en/regions/manchester"/>
<rule from="^ http://northern-indymedia.org" to=" https://northern-indymedia.org"/>
<rule from="^ http://www.northern-indymedia.org" to=" https://northern-indymedia.org"/>
<rule from="^ http://scotland.indymedia.org" to=" https://scotland.indymedia.org"/>
<rule from="^ http://indymedia.org.uk/en/regions/scotland" to=" https://www.indymedia.org.uk/en/regions/scotland"/>
<rule from="^ http://www.indymedia.org.uk/en/regions/scotland" to=" https://www.indymedia.org.uk/en/regions/scotland"/>
<rule from="^ http://indymedia.org.uk/en/regions/southcoast" to=" https://www.indymedia.org.uk/en/regions/southcoast"/>
<rule from="^ http://www.indymedia.org.uk/en/regions/southcoast" to=" https://www.indymedia.org.uk/en/regions/southcoast"/>
<rule from="^ http://www.southcoast.indymedia.org.uk" to=" https://www.indymedia.org.uk/en/regions/southcoast"/>
<rule from="^ http://southcoast.indymedia.org.uk" to=" https://www.indymedia.org.uk/en/regions/southcoast"/>
<rule from="^ http://sheffield.indymedia.org.uk" to=" https://sheffield.indymedia.org.uk"/>
<rule from="^ http://www.sheffield.indymedia.org.uk" to=" https://sheffield.indymedia.org.uk"/>
<rule from="^ http://sheffield.indymedia.org.uk" to=" https://sheffield.indymedia.org.uk"/>
</ruleset>

Radish


regular expressions

08.09.2010 17:13

Well in this:

<rule from="^http://([^/:@]*)\.indymedia\.org\.uk" to="https://$1.indymedia.org.uk"/>

The [^/:@] just means any character that isn't /, : or @. (The ^ at the start inside square brackets means anything not in this list. The ^ before the http has a totally different meaning: the start of the line.)
The * means repeated zero or more times.
The brackets () are so you can refer back to the string as $1 from the second expression.

It's true my version doesn't handle the local indymedias properly. I might try to do one that does them OK.

It seems that e.g.  http://liverpool.indymedia.org.uk/ redirects to  http://www.indymedia.org.uk/en/regions/liverpool but this is done after the https substitution is done, so by then it is too late.

Maybe an enhancement to the plugin could follow any redirects first before changing the URL to https. I'm not sure if that is possible without leaking data though, since you don't know if there is a redirect until you connect.

It would appear that in general it is better to put links to the local indymedias in the form  http://www.indymedia.org.uk/en/regions/blah instead of  http://blah.indymedia.org.uk/

anon


OK but

12.09.2010 14:47

I understand why we need secure connections, but don't understand all the babble in most of the above comments.

Have you guys with the knowledge got it sorted out yet, and if so can you put a new, simplified, article up explaining things in easy layman's terms for we uninitiated.

Thanks

Technofobe


Step by step instructions

18.09.2010 18:27

Does this help people like Technofobe ?

 http://penguin.ox4.org/node/397

(revised 18 Sept 2010)

Penguin