code review 6614064: godoc: fetch jQuery via https

godoc: fetch jQuery via https

[adg, 2012-10-07 23:34:54]

Hello rsc (cc: golang-dev@googlegroups.com),

I'd like you to review this change to
https://code.google.com/p/go

[bradfitz, 2012-10-07 23:39:17]

LGTM


On Sun, Oct 7, 2012 at 4:34 PM, <adg@golang.org> wrote:

> Reviewers: rsc,
>
> Message:
> Hello rsc (cc: golang-dev@googlegroups.com),
>
> I'd like you to review this change to
> https://code.google.com/p/go
>
>
> Description:
> godoc: fetch jQuery via https
>
> Please review this at
http://codereview.appspot.com/**6614064/<http://codereview.appspot.com/6614064/>
>
> Affected files:
>   M lib/godoc/godoc.html
>
>
> Index: lib/godoc/godoc.html
> ==============================**==============================**=======
> --- a/lib/godoc/godoc.html
> +++ b/lib/godoc/godoc.html
> @@ -8,7 +8,7 @@
>    <title>The Go Programming Language</title>
>  {{end}}
>  <link type="text/css" rel="stylesheet" href="/doc/style.css">
> -<script type="text/javascript" src="http://ajax.googleapis.**
>
com/ajax/libs/jquery/1.8.2/**jquery.min.js<http://ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js>
> "></script>
> +<script type="text/javascript" src="https://ajax.googleapis.**
>
com/ajax/libs/jquery/1.8.2/**jquery.min.js<https://ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js>
> "></script>
>  <script type="text/javascript">window.**jQuery ||
> document.write(unescape("%**3Cscript src='/doc/jquery.js'
> type='text/javascript'%3E%3C/**script%3E"));</script>
>  <script type="text/javascript" src="/doc/godocs.js"></script>
>  {{if .SearchBox}}
>
>
>

[adg, 2012-10-07 23:41:03]

*** Submitted as http://code.google.com/p/go/source/detail?r=21aca6261767 ***

godoc: fetch jQuery via https

R=rsc, bradfitz
CC=golang-dev
http://codereview.appspot.com/6614064

[dsymonds, 2012-10-08 00:39:48]

No, don't do this. Drop the protocol entirely. Then it uses HTTP on an
HTTP page, and HTTPS on an HTTPS page.

src="//ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js"

[bradfitz, 2012-10-08 00:44:26]

On Sun, Oct 7, 2012 at 5:39 PM, David Symonds <dsymonds@golang.org> wrote:

> No, don't do this. Drop the protocol entirely. Then it uses HTTP on an
> HTTP page, and HTTPS on an HTTPS page.
>
> src="//ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js"
>

see other thread.

[dsymonds, 2012-10-08 00:48:54]

On Mon, Oct 8, 2012 at 11:44 AM, Brad Fitzpatrick <bradfitz@golang.org> wrote:

> see other thread.

I still don't see the benefit of forcing HTTPS there.

[adg, 2012-10-08 01:56:45]

I don't want it to ever pull this over HTTP. It is an unnecessary security
risk.

On 8 October 2012 11:39, David Symonds <dsymonds@golang.org> wrote:
> No, don't do this. Drop the protocol entirely. Then it uses HTTP on an
> HTTP page, and HTTPS on an HTTPS page.
>
> src="//ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js"