@Bisaloo See also ppasset42kropoy6.onion.

@koops76, it's already listed in the top comment.

• The top comment should include a link to both https://www.propublica.org/nerds/a-more-secure-and-anonymous-propublica-using-tor-hidden-services and https://gist.githubusercontent.com/mtigas/0d49b42fab6f9d2f7e69/raw/2-tor (the first links to the second) to prove that these .onion sites are really associated with propublica.org. For example we could put this text, properly formatted, at the very top:

See https://www.propublica.org/nerds/a-more-secure-and-anonymous-propublica-using-tor-hidden-services for a discussion about ProPublica's .onion services. In particular, this page links to https://gist.githubusercontent.com/mtigas/0d49b42fab6f9d2f7e69/raw/2-tor which has a list of ProPublica .onion domains.

• Remove the redirects parenthetical comments. They are both unneeded and incorrect (https://ppasset42kropoy6.onion redirects to www.propub3r6espa33w.onion , not propub3r6espa33w.onion ; and http://pubapp7v22ykdou3.onion redirects to http://www.propub3r6espa33w.onion/tools/ , not clearnet, though the ultimate destination is http://www.propublica.org/newsapps/ ).
• Add a target for https://cdn.propub3r6espa33w.onion
• Add a target for https://projects.propub3r6espa33w.onion
• Add a target for https://static.propub3r6espa33w.onion
• Remove the securecookie tag, because these domains don't seem to set cookies.
• Update ruleset-whitelist.csv for ProPublica.org.xml.

@jeremyn Better keep securecookie anyway in case they will add cookies.

@Bisaloo Keep the securecookie please. If they do not have any cookies it's guaranteed to be safe, and if they start adding them it's better to secure them.

@Bisaloo Keep the securecookie please. If they do not have any cookies it's guaranteed to be safe, and if they start adding them it's better to secure them.

This is a bad idea. If they add cookies, we have no guarantee that they can be secured without breaking anything. We can't test it so let's not add it.

@koops76 I argue for very limited securecookie use in #2907 (comment) , and I describe a potential complicated problem with securecookie in #7527 (comment). I'm not really interested in re-arguing or reopening that discussion.

@Bisaloo Merged, thanks.