devinrhode2/kiss-include — pull request #1 by jmileham (2012-12-18 20:52:54+00:00)
Title: Force KM to send events via SSL

Hey Devin,

Thought you might find this interesting. This is a pretty hacky implementation, but the way KM's scripts are architected, it sort of ties your hands.

KISSmetrics will only use SSL to deliver events if `document.location` begins with `https`. Overriding KM.u with a function that has https on the front tricks it into using SSL even when `document.location` actually starts with `chrome:`, as is the case for background and popup views.

Since a KM-enabled chrome extension could easily accidentally leak sensitive information for a content script on an otherwise HTTPS site, I think it makes sense to bake this in as a default.

Whether the code passes muster in its current form is up to you -- monkey patching the KM object via setTimeout isn't super elegant, and could cause issues elsewhere, and/or be brittle if KM upgrades their libs. Ideally KM would upgrade their async loader to make SSL an explicit option (even if it defaults to matching the current URL scheme).