Points of Required Attention™
Please chime in on a proposed restructuring of the ROM hacking sections.
Views: 88,498,065
 Main | FAQ | Uploader | IRC chat | Radio | Memberlist | Active users | Latest posts | Calendar | Stats | Online users | Search 04-28-24 11:01 PM
Guest: Register | Login

0 users currently in Help/Suggestions/Bug Reports | 1 guest

Main - Help/Suggestions/Bug Reports - The SSL mode New thread | New reply


Do you use it regularly?
Yes
No
I use it from times to times
Multiple voting is not allowed. Changing your vote is allowed. 13 users have voted so far.

Mega-Mario
Posted on 06-14-10 02:19 AM Link | Quote | ID: 131985

Spamming from alt accounts.
Level: 81

Posts: 1041/1610
EXP: 4881193
Next: 111656

Since: 09-10-08

Last post: 3591 days
Last view: 3012 days 		I don't use it.

I must say, while it is nice having a secure board after the Swiss cheese Acmlm's board was, this may be an unneeded measure:

1. when people link externally with HTTPS links, other people get security warnings due to the custom certificate
2. it's not like Board2 is Paypal or some other website that transfers sensitive data
3. if there are security holes in the board, a SSL certificate is not going to fix those

Just giving my opinion, and being curious about others' opinions, and mostly curious about why that was implemented at all.

____________________
Kafuka -- ROM hacking
Kuribo64 -- we hack shit

Cellar Dweller
Posted on 06-14-10 03:11 AM Link | Quote | ID: 131987


Snifit
Level: 39

Posts: 284/287
EXP: 385264
Next: 19507

Since: 02-19-07
From: Arkansas

Last post: 4054 days
Last view: 3222 days 		IIRC, it was added for the benefit of users that are subjected to network based content filtering.

What I don't get is why the staff prefer the encryption when they are not subject to such filtering. They put https URLs in the PoRA box when relative links would be better. KP9000 even posted a picture on Jul with a https URL and drew a complaint from Xkeeper.

I don't think that the use of SSL was ever intended to protect against any vulnerability in the board code.

chungy
Posted on 06-14-10 06:21 AM Link | Quote | ID: 131990


Rex
Level: 51

Posts: 455/533
EXP: 960517
Next: 53421

Since: 08-23-07
From: Las Vegas

Last post: 4447 days
Last view: 4249 days 		the self-signed cert and nonstandard ports are fairly odd, the first one being a major issue tbh.

NightKev
Posted on 06-14-10 06:24 AM Link | Quote | ID: 131991


Cape Luigi
Level: 131

Posts: 4246/4792
EXP: 26235284
Next: 189336

Since: 03-15-07

Last post: 3737 days
Last view: 3649 days
I thought 81 was the standard https port?

____________________

paulguy
Posted on 06-14-10 06:27 AM Link | Quote | ID: 131992


Flurry
Level: 37

Posts: 245/258
EXP: 327045
Next: 11208

Since: 04-10-07
From: Buffalo, NY

Last post: 5030 days
Last view: 4571 days

The host probably just made it easy to implement, and likely there for the sake of completeness. As for why the IRC script links the protected site, I have no idea.

Also, the standard HTTPS port is 443, but that one's used for something else (Kinda breaks the point of bypassing content filters, since a lot will block everything that's not 80 or 443.).

____________________
"In other news, Scientists theoretize that CHEESECAKE CHEESECAKE CHEESECAKE." --Blackhole89

blackhole89
Posted on 06-14-10 12:35 PM Link | Quote | ID: 131993


The Guardian
Moloch whose eyes are a thousand blind windows!
Level: 124

Posts: 3147/4196
EXP: 21537238
Next: 299363

Since: 02-19-07
From: Ithaca, NY, US

Last post: 474 days
Last view: 86 days



Technically, the board code very carefully filters things in a manner that https links to the server will be turned into http links when accessed with an http connection and vice versa. Of course, this can't possibly affect posts others make elsewhere - but that is the respective posters' individual problem.

As for the self-signed certificate, I don't exactly feel like paying a three-digit sum to $certificateprovider - and using CAcert would solve nothing as most browsers don't seem to list it as a trusted certifier.

For the PoRA box, I agree about the relative URLs

443 is the standard https port, but that's used for SSH at the moment. Given that I don't rely on port 443 SSH anymore, I probably can change that though if demand is there.

____________________

Mega-Mario
Posted on 06-14-10 03:40 PM Link | Quote | ID: 131995

Spamming from alt accounts.
Level: 81

Posts: 1042/1610
EXP: 4881193
Next: 111656

Since: 09-10-08

Last post: 3591 days
Last view: 3012 days
Posted by blackhole89
Technically, the board code very carefully filters things in a manner that https links to the server will be turned into http links when accessed with an http connection and vice versa. Of course, this can't possibly affect posts others make elsewhere - but that is the respective posters' individual problem.

Then how come the PORA box still has a HTTPS link in HTTP mode? or does it only filter links in posts?

____________________
Kafuka -- ROM hacking
Kuribo64 -- we hack shit

blackhole89
Posted on 06-14-10 05:09 PM Link | Quote | ID: 131999


The Guardian
Moloch whose eyes are a thousand blind windows!
Level: 124

Posts: 3148/4196
EXP: 21537238
Next: 299363

Since: 02-19-07
From: Ithaca, NY, US

Last post: 474 days
Last view: 86 days



The PoRA box is not fed through the post filter, yes.

____________________

chungy
Posted on 06-17-10 02:31 AM Link | Quote | ID: 132051


Rex
Level: 51

Posts: 457/533
EXP: 960517
Next: 53421

Since: 08-23-07
From: Las Vegas

Last post: 4447 days
Last view: 4249 days
Posted by blackhole89
and using CAcert would solve nothing as most browsers don't seem to list it as a trusted certifier.

Does it matter? it's still *some* verification which is better than *none*.

Sure it's not supported by a whole lot of people (majority of Windows browsers don't have the cert, and it certainly doesn't come with Windows), but still clicking past an unverifiable certificate would be the same situation for those users as it is now. if they cared about verifying it against someone, they can.

Ailure
Posted on 06-21-10 12:00 PM Link | Quote | ID: 132241

Hats
Steam Board2 group
Level: 121

Posts: 3567/3965
EXP: 19783059
Next: 273637

Since: 02-19-07
From: Sweden, Skåne

Last post: 3304 days
Last view: 2054 days
I'm all for fixing the port thing at least, three less characters in the URL's and all that.

Even if not for CAcert, what would be the most affordable certificate authority?

____________________
AIM: gamefreak1337, MSN: Emil_sim@spray.se, XMPP: ailure@xmpp.kafuka.org

Main - Help/Suggestions/Bug Reports - The SSL mode New thread | New reply

Acmlmboard 2.1+4δ (2023-01-15)
© 2005-2023 Acmlm, blackhole89, Xkeeper et al.

Page rendered in 0.025 seconds. (323KB of memory used)
MySQL - queries: 59, rows: 79/80, time: 0.016 seconds.