From 6222597ef035af27f5c05ab4cee04cc2909c2a64 Mon Sep 17 00:00:00 2001
From: Andreas Schildbach <andreas@schildbach.de>
Date: Mon, 28 Oct 2019 10:17:10 +0100
Subject: [PATCH] network_security_config.xml: Convert to a whitelist of
 domains that still cannot use HTTPS.

---
 oeffi/res/xml/network_security_config.xml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/oeffi/res/xml/network_security_config.xml b/oeffi/res/xml/network_security_config.xml
index 8158fe4..320e39d 100644
--- a/oeffi/res/xml/network_security_config.xml
+++ b/oeffi/res/xml/network_security_config.xml
@@ -1,10 +1,25 @@
 <?xml version="1.0" encoding="utf-8"?>
 <network-security-config>
 
-    <base-config cleartextTrafficPermitted="true" >
+    <!-- Most public transport authorities have their servers configured securely these days. -->
+    <base-config cleartextTrafficPermitted="false">
         <trust-anchors>
             <certificates src="system" />
         </trust-anchors>
     </base-config>
 
+    <!-- This is the hall of shame: public transport authorities which still do not support HTTPS. -->
+    <domain-config cleartextTrafficPermitted="true">
+        <domain includeSubdomains="false">www.belgianrail.be</domain><!-- SNCB/NMBS -->
+        <domain includeSubdomains="false">android.vrsinfo.de</domain><!-- VRS -->
+        <domain includeSubdomains="false">wojhati.rta.ae</domain><!-- RTA Dubai -->
+        <domain includeSubdomains="false">appefa10.verbundlinie.at</domain><!-- STV -->
+        <domain includeSubdomains="false">railteam.hafas.eu</domain><!-- Railteam -->
+        <domain includeSubdomains="false">mobil.vbl.ch</domain><!-- VBL -->
+        <domain includeSubdomains="false">efa.vvo-online.de</domain><!-- VVO -->
+        <domain includeSubdomains="false">mobil.rozklad-pkp.pl</domain><!-- PKP -->
+        <domain includeSubdomains="false">efa.mobilitaetsverbund.de</domain><!-- VVM -->
+        <domain includeSubdomains="false">fahrplan.sbb.ch</domain><!-- SBB -->
+    </domain-config>
+
 </network-security-config>