Https-everywhere: Reimplement SSL Observatory for Firefox

[ansell]

Type: feature request

The SSL Observatory can be reimplemented for Firefox-62+ WebExtensions using the API created in this bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1322748

(I realise this may not happen soon since the Firefox-60 ESR which doesn't have this feature is likely to be supported for a while, but opening this to keep track of it)

[Hainish]

It seems that Firefox has decided to go with entirely their own API for TLS introspection instead of adopting the one we are working with Chromium devs on developing, and is slowly being implemented in Chrome.

I'd like to make sure the API we pick will be standardized in all the browsers we support. This divergence is a little troublesome for our own implementation needs, and I'd like to not develop two separate code paths for Firefox and Chrome. I think it's worth waiting until the browsers figure this out.

[pipboy96]

@Hainish @zoracon Am I welcome to start implementing this with Firefox's current API?

[zoracon]

@Hainish @zoracon Am I welcome to start implementing this with Firefox's current API?

I'll confirm if the API issues were sorted out and get back to you

[Giltyhub]

@zoracon ping

[pipboy96]

@Giltyhub re. what?

[Giltyhub]

@pipboy96 re your request above to him. Did you get an answer? if so sorry for the disturbance

[pipboy96]

@Giltyhub No.

[pipboy96]

This seems unlikely to happen due to lack of requisite APIs in Chrome and EFF team responsible for SSL Observatory moving to work on Let's Encrypt (from what I get from conversation with @andresbase).

[JamesTheAwesomeDude]

I know this is a weird question, but- is the SSL Observatory server still running?

webRequest.getSecurityInfo() now includes raw DER passthrough support, if called with {"rawDER": true}.

[pipboy96]

@JamesTheAwesomeDude This API is Firefox-only. The server had been shut down after XPCOM has been deprecated in Firefox. IMO the best option would be to remake the observatory as a separate add-on, not include it in HTTPS Everywhere again.