Move to https://

[andrewjs18]

I've seen a lot of things around here, but this is a doosey. Guy wants https but cites google as an example of security and/or privacy.

Here's a better idea. Stop using google and worry less about PAFOA.

google does rank sites higher with https than those without it.

[QuackXP]

that's not entirely true. often times passwords are also sent in plain text.



it'll likely be a big task as you're going to need to proxy ALL external avatars and images posted on pafoa.org to avoid mixed content warnings in the browser...this also assumes that you allow users to user avatars from remote locations and such.

Or danp could go full BOFH and disallow any external content and just break what is currently out there.

[danp]

the point of the image proxy is to rewrite urls that aren't using https. so an image linked from http://somesite.com/image.jpg would be proxied to something like https://ssl.pafoa.org/image.jpg or something along those lines.

github had to do this for their own stuff and ended up releasing an http to https proxy for free. I'm sure this can be made to work with vbulletin: https://github.com/atmos/camo

This unfortunately seems impractical for a few reasons:

• I don't control the vBulletin code and can't force it to rewrite the content of posts to change the URLs.
• This would add non-insignificant server/bandwidth costs to us as it shuttles images back and forth.
• This would introduce new points-of-failure in the infrastructure.

Stupid technology

[streaker69]

How will going to https affect Tapatalk?

[phillyd2]

How will going to https affect Tapatalk?

It will work exactly as well as it does now.

[pyld]

Or danp could go full BOFH and disallow any external content and just break what is currently out there.

That has the potential to screw up the ad payday (I haven't seen them for years, but I'm assuming they are also unencrypted and coming from truly external URIs and not rewritten).

[andrewjs18]

This unfortunately seems impractical for a few reasons:

• I don't control the vBulletin code and can't force it to rewrite the content of posts to change the URLs.
• This would add non-insignificant server/bandwidth costs to us as it shuttles images back and forth.
• This would introduce new points-of-failure in the infrastructure.

Stupid technology

meh..if you think it's ok to have some pages load (note, probably most of them) with mixed content warnings, go for it without proxying non-https images/resources.

[bigandy1966]

And those of us that post occasionaly from work, won't have more to worry so much about if we post something that's "Contrary to corporate policies or political agendas"

[pyld]

And those of us that post occasionaly from work, won't have more to worry so much about if we post something that's "Contrary to corporate policies or political agendas"

I'm not sure why you think that. If your employer has half a brain and you are using their endpoint, they will know. If they have half a brain and take the time to do "their own" CA thing and seed your browser, they will know. If you believe that posting to PAFOA from work is going to cause you problems, you should probably assume that SSL/TLS won't solve them.