Observatory by Mozilla – automated website security testing tool (opens in new tab)

(observatory.mozilla.org)

61 pointschuckharmston9y ago11 comments

11 comments

I'm the primary developer of the scanner and website, and would be happy to answer anybody's questions, should they have any. :)

starfox64_9y ago

I've been running a few tests progressively fixing various issues and now I'm getting an "Error: Site down" error however I am still able to access my website over HTTP and HTTPS on my browser.

bigtones9y ago

Microsoft and Google both score a "D", Mozilla itself scores a "D-", Apple and Amazon both score an "F"

marumari9y ago

On the plus side, there are sites doing really well, like GitHub (A+), HackerOne (A+), and Twitter (A). Even Facebook is doing pretty well, with a B. Hopefully sites like the Observatory help sites do better.

We're working really hard on getting mozilla.org to the point where it also gets an A+.

mc429y ago

I find it interesting how the first website ever, being info.cern.ch, fails 6 of the 10 tests, getting a 0/100.

marumari9y ago

It also has an invalid website certificate. Kind of a shame that it's so neglected, but it's a pretty good example of what happens to sites when they're allowed to sit for too long.

mc429y ago

I was under the impression it was recently updated for the 25th anniversary. However, I can understand not adding "security" in the name of preservation. Real shame.

1 more reply

galaktor9y ago

I find it interesting (and a bit disappointing) that while github.com gets an A, a static page I host on github pages received an F. Would be great if Github would help pages hosted there be more secure by default.

technion9y ago

Which of the security tests performed by this tool do you feel have a significant impact on a static page?

Some of these things, such as subresource integrity, will be down to you and what you do with the code. Many of these tests have very little baring on how 'secure' a static page is.

manigandham9y ago

A lot of these headers are repetitive, need to standardize instead of just making more convoluted options.

j / k navigate · click thread line to collapse

11 comments

marumari9y ago

I'm the primary developer of the scanner and website, and would be happy to answer anybody's questions, should they have any. :)

starfox64_9y ago

I've been running a few tests progressively fixing various issues and now I'm getting an "Error: Site down" error however I am still able to access my website over HTTP and HTTPS on my browser.

bigtones9y ago

Microsoft and Google both score a "D", Mozilla itself scores a "D-", Apple and Amazon both score an "F"

marumari9y ago

We're working really hard on getting mozilla.org to the point where it also gets an A+.

mc429y ago

I find it interesting how the first website ever, being info.cern.ch, fails 6 of the 10 tests, getting a 0/100.

marumari9y ago

It also has an invalid website certificate. Kind of a shame that it's so neglected, but it's a pretty good example of what happens to sites when they're allowed to sit for too long.

mc429y ago

I was under the impression it was recently updated for the 25th anniversary. However, I can understand not adding "security" in the name of preservation. Real shame.

1 more reply

galaktor9y ago

technion9y ago

Which of the security tests performed by this tool do you feel have a significant impact on a static page?

Some of these things, such as subresource integrity, will be down to you and what you do with the code. Many of these tests have very little baring on how 'secure' a static page is.

manigandham9y ago

A lot of these headers are repetitive, need to standardize instead of just making more convoluted options.

j / k navigate · click thread line to collapse