Hi,

Even when accessed using HTTPS itself, bugs.d.o/release-critical and
its subpages contain absolute HTTP links to other URLs within the BTS;
e.g.:

<strong>Package:</strong></a> <A HREF="http://bugs.debian.org/cgi-bin/p
kgreport.cgi?archive=no&pkg=389-admin">389-admin</A>; 

Please either always use HTTPS for such links, or at least protocol-
agnostic links (so that accessing the index via HTTPS gives secure
onward links).

Regards,

Adam

I am another user who would like to see this misfeature fixed.

I used to visit the [RC bug count page] on Firefox with the HTTPS
Everywhere extension enabled (package 'webext-https-everywhere') and
everything looked OK, with the web server nicely communicating over
TLS/SSL (certificate verified by Let's Encrypt), even after following
the hyperlinks to specific bug reports.

[RC bug count page]: <https://bugs.debian.org/release-critical/>

But HTTPS Everywhere is going to be [retired] on January 2023, since
browsers are now able to accomplish its goal by a simple setting.

[retired]: <https://www.eff.org/https-everywhere/set-https-default-your-browser>

Hence, I removed package 'webext-https-everywhere' and configured
Firefox as suggested.
And I started to experience the following issue with the [RC bug count
page].
Links are in the form

  <em><a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?archive=no&pkg=src:twopaco">src:twopaco</a>:</em>
  <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?archive=no&bug=1013182">1013182</a>

If I click on either link, I see a Firefox warning:

| HTTPS-Only Mode Alert
| Secure Connection Not Available
|
| You’ve enabled HTTPS-Only Mode for enhanced security, and a HTTPS
| version of bugs.debian.org is not available.
[...]
|          {Continue to HTTP Site}  {Go Back}

If I click on the {Continue to HTTP Site} button, the final result is
an HTTPS page, but, well..., all this is not really nice.


I tried to modify the HTML code (with Firefox inspector) into the much
simpler:

  <em><a href="../src:twopaco">src:twopaco</a>:</em>
  <a href="../1013182">1013182</a>

It seems to work: if I click on either link, I am directly taken to the
corresponding HTTPS page, without any warning.

Could the links be generated in the latter form?
I think it would be both simpler and more functional.

Thanks for your time!