Domain redirects should be verified

[j-manu]

Though I applaud the intent behind https-everywhere, rewriting a CDN domain name to S3 bucket is very problematic.

1. You cannot guarantee that the domain will always resolve to that S3 bucket and apparently there are no checks to ensure that domain names are resolving to the S3 bucket (as happened in Please disable rule for PrintFriendly #2708 )
2. Bucket names can be reused. If I delete the S3 bucket someone else can create a bucket with that name. Even if the original owner updated his code to not use the bucket anymore, https-everywhere will continue redirecting and end users will not be aware of it. I think this is a bigger threat to privacy than not having SSL.

[jeremyn]

I agree that rewriting anything to an S3 bucket is a bad idea. I think reviewers should not allow that in future rulesets. @fuglede @Hainish @J0WI What do you all think?

[jeremyn]

Here is another example of rewriting to an external CDN, this time to CloudFront.

[J0WI]

It's sometimes necessary to avoid mismatching certs and mixed content, but indeed they need special attention during the review process.
Test urls can help to detect broken redirects.

[jeremyn]

Issue #6624 is related.

[jeremyn]

As @j-manu said though, bucket names can be reused. It doesn't matter how careful we are during the review process. After the rule is merged, all that needs to happen is for @j-manu to delete the bucket and for someone else to claim the name, and now we're directly creating a MITM situation.

[fuglede]

Do people have any control of the names of buckets they use? How are the subdomains generated in the CF case, and are the Amazon ones really open to anybody?

[jeremyn]

Here is Amazon S3 documentation:

Bucket ownership is not transferable; however, if a bucket is empty, you can delete it. After a bucket is deleted, the name becomes available to reuse, but the name might not be available for you to reuse for various reasons. For example, some other account could create a bucket with that name. Note, too, that it might take some time before the name can be reused. So if you want to use the same bucket name, don't delete the bucket.

So @j-manu 's situation was that they had a bucket named cdn.printfriendly.com accessible at https://s3.amazonaws.com/cdn.printfriendly.com/ . If they deleted the bucket, I can claim it later and now the PrintFriendly.com ruleset will redirect to a URL under my control.

I don't know how it works with CloudFront.

[fuglede]

Thanks for the reference. Am I wrong or are they saying that everybody but the original owner can use the bucket name? Seems a bit strange. In any case, I agree that that's not ideal. I seem to remember that some subset of the Amazon buckets were removed a while ago, but the exact occurrence escapes me.

[jeremyn]

There might be weird backend things happening that make it difficult for a former owner to immediately reuse a bucket with the same name. If so, that is probably unintentional.

[pipboy96]

I want to do exactly that, checking which CDN unwrapping redirects are still neccesary, and which should be turned into trivial rewrites.

[zoracon]

Mentioning #17912

Once that issue closes we can close this one