Hacker News Reader

Yes, this (Chrome not allowing the script to be run) is a good thing. The bookmarklet javascript needs to be served over HTTPS and any communication it makes also need to be over SSL. Seriously if you aren't defaulting to HTTPS for your website and or service in 2014 you're doing it wrong. Plain text HTTP needs to go the way of telnet.

View on HN

er.. sorry what? Squirt is using plain text HTTP. This is definitely a bad thing.

From Chrome Dev Tools:

"..was loaded over HTTPS, but ran insecure content from 'http://www.squirt.io/bm/squirt.js': this content should also be loaded over HTTPS."

I would have thought that if you read my entire post that I meant that Chrome blocking it is a good thing. I will edit the comment to make that more clear.

Why not just replace "http://" with "//" in your Bookmarklet code?

Reply on news.ycombinator.com