Last modified: 2014-10-31 20:29:11 UTC
This may need to be split out to separate bug reports. The annual fundraising e-mail contains this text: --- You are receiving this email as a valued donor of the Wikimedia Foundation. If you do not wish to receive any future emails from the Wikimedia Foundation, unsubscribe instantly. --- "unsubscribe instantly" is a link to <https://links.email.donate.wikimedia.org/>. This domain doesn't have a valid SSL certificate, so the browser throws a terrifying warning. This is bad. If the user chooses to proceed, he or she is presented with an awful form (so much for instantly unsubscribing...): --- Opt-out Email Confirmation Enter Email: [ ] [No, I do NOT wish to Unsubscribe] [Yes, Unsubscribe me] --- Requiring the user to re-enter his or her e-mail address is a pretty dickish move. And finally, "No, I do NOT wish to Unsubscribe" is abominable language. The only way the user can figure out what that button does is by reading the other button and realizing it's the "Yes" button that he or she wants.
(In reply to comment #0) > "unsubscribe instantly" is a link to > <https://links.email.donate.wikimedia.org/>. This domain doesn't have a valid > SSL certificate, so the browser throws a terrifying warning. This is bad. I see no such warning in current Firefox or Safari. The form looks pretty awful though.
Created attachment 14074 [details] Screenshot of https://links.email.donate.wikimedia.org in Google Chrome, OS X, 2013-12-12 (In reply to comment #1) > I see no such warning in current Firefox or Safari. Perhaps specific to Chrome? Uploaded a screenshot.
(In reply to comment #1) > I see no such warning in current Firefox or Safari. Using Firefox 25.0 on Linux, for me it displays the security warning about invalid certificate, with the same reason as the screenshot of attachment 14074 [details]
Curious, I had no trouble earlier today but now I do see the dread warning in Firefox. Mysterious indeed? "The certificate is only valid for *.links.mkt41.net" Bumping up prio.
Confirming "Untrusted cert" warning for https://links.email.donate.wikimedia.org/ links.email.donate.wikimedia.org uses an invalid security certificate. The certificate is only valid for *.links.mkt41.net (Error code: ssl_error_bad_cert_domain)
Setting highest prio; I don't see how opt'ing out of an annual email requires immediate action. Now somebody please ping the Fundraising folks. ;)
Oh; we're aware of this all right. There's just not much we can actually do about it at this point. We tried fixing it but it broke other things... so we're delaying on this until after the fundraiser. Our current position is that individuals using something like SSL Everywhere are an edgecase; and that a unsubscribe page that works consistently is currently better than one that doesn't work at all.
[Resetting severity & priority as per comment 7]
