Move to https://

[free]

My error. I meant technology that you don't personally use.
http://forum.pafoa.org/showthread.ph...57#post3245657

well, if I don't know what something is, I can hardly be expected to express an interest in using it.

By the same token, just because I don't know what something is doesn't necessarily mean I would have no interest in it, upon becoming aware of its existence.

[alpacaheat]

What's Tapatalk?

Annoying.




Not sent via Tapatalk, on an iPhone, Android or toaster

[alpacaheat]

ot having every freaking post I make end up like this.
I'd be more interested in n

YES!!!!!


I hate this so much!

[danp]

How much money do you need from us for it?

$0.000 (rounded to the nearest thousandth for clarity), since we are hosted on Amazon Web Services, they give us unlimited free SSL certificates.

Still working on this, I unfortunately am not in a position where I can reliably support such a large infrastructure change at the moment, but most of the code changes are done locally. I need to wait until I have a day or two where I can be around to deal with any problems that arise from deploying it. Not 100% sure when that is going to bet yet.

[pyld]

$0.000 (rounded to the nearest thousandth for clarity), since we are hosted on Amazon Web Services, they give us unlimited free SSL certificates.

Still working on this, I unfortunately am not in a position where I can reliably support such a large infrastructure change at the moment, but most of the code changes are done locally. I need to wait until I have a day or two where I can be around to deal with any problems that arise from deploying it. Not 100% sure when that is going to bet yet.

Don't do that shit from an SEZ, because you will negate the value of installing the SSL in the first place .

[BobFromBucks]

Don't think this was posted. Good information here for you to use.

https://www.eff.org/https-everywhere

HTTPS Everywhere is produced as a collaboration between The Tor Project and the Electronic Frontier Foundation. Many sites on the web offer some limited support for encryption over HTTPS, but make it difficult to use. For instance, they may default to unencrypted HTTP, or fill encrypted pages with links that go back to the unencrypted site. The HTTPS Everywhere extension fixes these problems by using clever technology to rewrite requests to these sites to HTTPS. Information about how to access the project's Git repository and get involved in development is here.

[andrewjs18]

Forces the server to use Encryption between it and you. That way things can't be eavesdropped on in the stream between the server and you. Right now, anything that isn't a password is sent in plain text across the inturwebs without you knowing what route it's getting there nor who might be listening along the way. Setting it to HTTPS encrypts all the traffic, not just the password.

Of course, this is all aside if those that you want to keep from reading it don't already have the master key to SSL.

that's not entirely true. often times passwords are also sent in plain text.

$0.000 (rounded to the nearest thousandth for clarity), since we are hosted on Amazon Web Services, they give us unlimited free SSL certificates.

Still working on this, I unfortunately am not in a position where I can reliably support such a large infrastructure change at the moment, but most of the code changes are done locally. I need to wait until I have a day or two where I can be around to deal with any problems that arise from deploying it. Not 100% sure when that is going to bet yet.

it'll likely be a big task as you're going to need to proxy ALL external avatars and images posted on pafoa.org to avoid mixed content warnings in the browser...this also assumes that you allow users to user avatars from remote locations and such.

[danp]

it'll likely be a big task as you're going to need to proxy ALL external avatars and images posted on pafoa.org to avoid mixed content warnings in the browser...this also assumes that you allow users to user avatars from remote locations and such.

This is the largest gap. I'm not even sure it's reasonably pluggable as I have very little control over how vBulletin handles image embeds and can't even guarantee the embedded images people post support SSL even if I were to be able to rewrite the link.

We may have just to accept that SSL+content warnings is better than No SSL.

Either way, I just got home yesterday and in the coming weeks will have more time to look into this between looking for a new place to live.

Thanks for everyone's understanding and support!

[andrewjs18]

This is the largest gap. I'm not even sure it's reasonably pluggable as I have very little control over how vBulletin handles image embeds and can't even guarantee the embedded images people post support SSL even if I were to be able to rewrite the link.

We may have just to accept that SSL+content warnings is better than No SSL.

Either way, I just got home yesterday and in the coming weeks will have more time to look into this between looking for a new place to live.

Thanks for everyone's understanding and support!

the point of the image proxy is to rewrite urls that aren't using https. so an image linked from http://somesite.com/image.jpg would be proxied to something like https://ssl.pafoa.org/image.jpg or something along those lines.

github had to do this for their own stuff and ended up releasing an http to https proxy for free. I'm sure this can be made to work with vbulletin: https://github.com/atmos/camo

[ungawa]

Just one man's suggesting - move this whole site to require https:// just like google is doing now.

I've seen a lot of things around here, but this is a doosey. Guy wants https but cites google as an example of security and/or privacy.

Here's a better idea. Stop using google and worry less about PAFOA.