
<!--
	Other Tumblr rulesets:

		- Tmblr.co.xml
		- Txmblr.com.xml


	CDN buckets:

		- s3.amazonaws.com/assets.tumblr.com/
		- s3.amazonaws.com/data.tumblr.com/
		- s3.amazonaws.com/static.tumblr.com/

		- d2g9v1gts353nd.cloudfront.net

			- a
			- v

		- d2glp9604qyu8g.cloudfront.net

			- assets

		- d2pi0bc9ewx28h.cloudfront.net

			- static

		- degx20iof9o2c.cloudfront.net

			- vt

		- dssedc4qxg7o6.cloudfront.net

			- media
			- \d+.media

		- duktadvmmowhi.cloudfront.net

			- secure.static

		- cs38.wac.edgecastcdn.net/...

			- secure.assets

		- wac.19b6.edgecastcdn.net/??19B6/

			- platform.tumblr.com

		- gs1.wac.edgecastcdn.net/8019B6/data.tumblr.com/
		- a.tumblr.com.edgesuite.net
		- assets.tumblr.com.edgesuite.net
		- media.tumblr.com.edgesuite.net
		- static.tumblr.com.edgesuite.net
		- vt.tumblr.com.edgesuite.net


	Nonfunctional subdomains:

		- developers *
		- engineering *
		- staff *
		- \w+ *

	* Dropped
	* Dropped, per-account vhosts


	Problematic subdomains:

		- data *
		- media *
		- 25.media *
		- 37.media *

	* Mismatched


	Fully covered subdomains:

		- a
		- assets	(→ d2glp9604qyu8g.cloudfront.net)
		- secure.assets
		- data
		- media		(→ 31.media)
		- *.media:
		- mx
		- platform
		- px.srvcs
		- static	(→ d2g9v1gts353nd.cloudfront.net)
		- secure.static
		- tm319
		- v
		- vt


	These altnames don't exist:

		- origin.assets.tumblr.com
		- assets.embed.tumblr.com
		- origin.platform.tumblr.com


	Insecure cookies are set for these domains:

		- .tumblr.com
		- .srvcs.tumblr.com
		- www.tumblr.com


	Mixed content:

		- Bugs on www from b.scorecardresearch.com *

	* Secured by us


	Users should enable tls support in tumblr settings:

		http://staff.tumblr.com/post/75482980993/you-can-now-take-extra-precaution-against-hackers

	Unfortunately, per-user subdomains don't support https either, so users
	are still vulnerable whenever they browse blogs while logged in. :(

-->
<ruleset name="Tumblr.com (partial)">

	<!--	Direct rewrites:
				-->
	<target host="tumblr.com" />
	<target host="a.tumblr.com" />
	<target host="assets.tumblr.com" />
	<target host="secure.assets.tumblr.com" />
	<target host="embed.tumblr.com" />
	<target host="*.media.tumblr.com" />
	<target host="mx.tumblr.com" />
	<target host="platform.tumblr.com" />
	<target host="px.srvcs.tumblr.com" />
	<target host="secure.static.tumblr.com" />
	<target host="tm319.tumblr.com" />
	<target host="v.tumblr.com" />
	<target host="vt.tumblr.com" />
	<target host="www.tumblr.com" />

	<!--	Complications:
				-->
	<target host="data.tumblr.com" />
	<target host="media.tumblr.com" />
	<target host="static.tumblr.com" />

		<!--	These scripts now break when rewritten to s://assets, secure.assets, or cloudfront:

				- dashboard.js breaks "like"ing
				- jquery_backbone_lodash.js and polyfills.js individually cause the editor to spawn another page
				- posting.js breaks opening the editor
				- tiny_mce.js breaks editing

			and lo, many bellyfeel boos were heard.
								-->
		<!--exclusion pattern="^http://assets\.tumblr\.com/assets/scripts/(dashboard|polyfills|posting|vendor/(jquery_backbone_lodash|tiny_mce_3_5_10/tiny_mce))\.js" /-->
		<!--
			And so was one "oh, fsck it."
							-->
		<!--exclusion pattern="^http://assets\.tumblr\.com/assets/scripts/" /-->
		<!--
			...but secure css:
						-->
		<exclusion pattern="^http://assets\.tumblr\.com/+assets/scripts/(?!vendor/\w+/plugins/\w+/css/)" />

			<test url="http://assets.tumblr.com/assets/scripts/" />
			<test url="http://assets.tumblr.com/assets/scripts/dashboard.js" />
			<test url="http://assets.tumblr.com/assets/scripts/polyfills.js" />
			<test url="http://assets.tumblr.com/assets/scripts/posting.js" />
			<test url="http://assets.tumblr.com/assets/scripts/vendor/jquery_backbone_lodash.js" />
			<test url="http://assets.tumblr.com/assets/scripts/vendor/tiny_mce_3_5_10/tiny_mce.js" />

		<!--
			Breaks hover interaction:
						-->
		<!--exclusion pattern="^http://(www\.)?tumblr\.com/svc/[\w-]+/posts/highlighted\?" /-->
		<!--
			Breaks "like"ing, strangely enough:
								-->
		<!--exclusion pattern="^http://(www\.)?tumblr\.com/svc/like\?" /-->
		<!--
			Breaks dashboard post loading:
							-->
		<!--exclusion pattern="^http://(www\.)?tumblr\.com/svc/post/fetch\?" /-->


	<!--	Tracking cookies:
					-->
	<securecookie host="^(?:secure\.assets|www)\.tumblr\.com$" name="^__utmf$" />
	<!--
		Not secured by server:
					-->
	<!--securecookie host="^\.tumblr\.com$" name="^(language|logged_in)$" /-->
	<!--securecookie host="^\.srvcs\.tumblr\.com$" name="^anon_id$" /-->
	<!--securecookie host="^www\.tumblr\.com$" name="^(capture|devicePixelRatio|documentWidth|last_toast|pfe|pfp|pfu|tmgioct)$" /-->

	<securecookie host="^\.srvcs\.tumblr\.com$" name=".+" />
	<securecookie host="^www\.tumblr\.com$" name="^d(?:evicePixelRatio|ocumentWidth)$" />


	<rule from="^http://data\.tumblr\.com/"
		to="https://gs1.wac.edgecastcdn.net/8019B6/data.tumblr.com/" />

	<rule from="^http://(?:(?:25|37)\.)?media\.tumblr\.com/"
		to="https://31.media.tumblr.com/" />

		<test url="http://25.media.tumblr.com/" />
		<test url="http://37.media.tumblr.com/" />

	<rule from="^http://static\.tumblr\.com/"
		to="https://d2pi0bc9ewx28h.cloudfront.net/" />

	<rule from="^http:"
		to="https:" />

</ruleset>
