Send an email to listing owners about deprecation of http URLs for listings

IIRC, @cguindon mentioned that he can create a script to do that from Drupal. This should not be done before #85 (closed) is completed so that we can point listing owners to some docs.

added prioritylow severitylow team:security labels

marked this issue as related to #85 (closed)

@cguindon is it something you can schedule for Q4?

IIRC, @cguindon mentioned that he can create a script to do that from Drupal. This should not be done before #85 (closed) is completed so that we can point listing owners to some docs.

The view already exists. We should be able to send an email whenever you are ready. You just need to provide the content of your email and the date/time you wish to send this out!

added stateblock label

added team:webdev label

assigned to @epoirier

mentioned in issue eclipsefdn/security/public-tasks#1 (closed)

@mbarbero do you have a week in particular you'd like to get this done in Q4?

Thanks.

Ideally, I would like this to be sent on week 42 (Oct 17th - 21st)

Ok no problem, as @cguindon said, the mechanism is already in place to send an email to listing owners. You just need to provide the content of your email and I can send the email on Oct 17th.

actually, I'd like to make it a bit earlier than that. I've set the due date to Oct 4th. I'll provide the text before that.

Thanks!

Hi @mbarbero, your due date is tomorrow. Can you provide the text sometime today so we are prepared to send tomorrow morning?

Thanks.

Here it is. Thanks @epoirier!

Dear Eclipse Marketplace Listing Owner,

TL;DR, if you have a listing on the marketplace using plain http, go update it as soon as possible to https as this will be enforced soon. Details below.

As stewards of the Eclipse Marketplace, the Eclipse Foundation is responsible for providing a safe place for the Eclipse IDE users to download their plugins. While the Eclipse Marketplace does not host or transmit the plugins bits, it provides links to (p2) repositories containing them. Until today, there was no restriction on those links.

Beginning December 15, 2022, the Eclipse Marketplace will no longer support links to repositories over plain HTTP. The goal is to protect users of the Eclipse Marketplace from the main risk of plain HTTP links: man-in-the-middle (MITM) attacks.

We will roll out this new requirement in 4 steps:

• Since September 20, 2022, a banner is displayed on the Eclipse Marketplace website homepage to spread awareness of the upcoming changes.
• On October 14, 2022, the banner will start to be displayed on all Eclipse Marketplace pages and new validation rules will be added to the Eclipse Marketplace backend. New solutions will not be allowed to use links to repositories over plain HTTP and existing solutions will not be able to edited if they still link content over plain HTTP.
• On December 15, 2022, all non-compliant solutions will be deactivated and won’t be displayed anymore on the Marketplace website. Owners will still be able to fix those for a limited period and get them re-instated.
• On January 30, 2023, all deactivated solutions that have not been fixed will be permanently deleted.

If you own a listing with plain http references to p2 repositories, we encourage you to update them as soon as possible with https. You will get frequently reminders before termination, but the sooner you do it, the lesser emails you will get ! You can also listen to our public tracking issue to stay informed about these changes.

Thanks!

Thanks. Do you have a prefered time for tomorrow?

I was thinking of sending the email when i'm starting my day at around 7:30AM my time but it's up to you.

7:30am EST is perfectly fine. Thanks!

changed due date to October 04, 2022

@mbarbero the email was sent to listing owners this morning.

Let me know if there's anything else.

Thanks.

removed the relation with #85 (closed)

closed