Points of Required Attention™
Please chime in on a proposed restructuring of the ROM hacking sections.
Views: 88,584,285
 Main | FAQ | Uploader | IRC chat | Radio | Memberlist | Active users | Latest posts | Calendar | Stats | Online users | Search 05-14-24 12:28 PM
Guest: Register | Login

0 users currently in Help/Suggestions/Bug Reports | 1 guest

Main - Help/Suggestions/Bug Reports - The SSL mode New thread | New reply


Do you use it regularly?
Yes
No
I use it from times to times
Multiple voting is not allowed. Changing your vote is allowed. 13 users have voted so far.

Mega-Mario
Posted on 06-14-10 02:19 AM Link | Quote | ID: 131985

Spamming from alt accounts.
Level: 81

Posts: 1041/1610
EXP: 4887840
Next: 105009

Since: 09-10-08

Last post: 3607 days
Last view: 3027 days 		I don't use it.

I must say, while it is nice having a secure board after the Swiss cheese Acmlm's board was, this may be an unneeded measure:

1. when people link externally with HTTPS links, other people get security warnings due to the custom certificate
2. it's not like Board2 is Paypal or some other website that transfers sensitive data
3. if there are security holes in the board, a SSL certificate is not going to fix those

Just giving my opinion, and being curious about others' opinions, and mostly curious about why that was implemented at all.

____________________
Kafuka -- ROM hacking
Kuribo64 -- we hack shit

Cellar Dweller
Posted on 06-14-10 03:11 AM Link | Quote | ID: 131987


Snifit
Level: 39

Posts: 284/287
EXP: 385741
Next: 19030

Since: 02-19-07
From: Arkansas

Last post: 4070 days
Last view: 3237 days 		IIRC, it was added for the benefit of users that are subjected to network based content filtering.

What I don't get is why the staff prefer the encryption when they are not subject to such filtering. They put https URLs in the PoRA box when relative links would be better. KP9000 even posted a picture on Jul with a https URL and drew a complaint from Xkeeper.

I don't think that the use of SSL was ever intended to protect against any vulnerability in the board code.

chungy
Posted on 06-14-10 06:21 AM Link | Quote | ID: 131990


Rex
Level: 51

Posts: 455/533
EXP: 961743
Next: 52195

Since: 08-23-07
From: Las Vegas

Last post: 4462 days
Last view: 4264 days 		the self-signed cert and nonstandard ports are fairly odd, the first one being a major issue tbh.

NightKev
Posted on 06-14-10 06:24 AM Link | Quote | ID: 131991


Cape Luigi
Level: 131

Posts: 4246/4792
EXP: 26267896
Next: 156724

Since: 03-15-07

Last post: 3752 days
Last view: 3664 days
I thought 81 was the standard https port?

____________________

paulguy
Posted on 06-14-10 06:27 AM Link | Quote | ID: 131992


Flurry
Level: 37

Posts: 245/258
EXP: 327453
Next: 10800

Since: 04-10-07
From: Buffalo, NY

Last post: 5046 days
Last view: 4586 days

The host probably just made it easy to implement, and likely there for the sake of completeness. As for why the IRC script links the protected site, I have no idea.

Also, the standard HTTPS port is 443, but that one's used for something else (Kinda breaks the point of bypassing content filters, since a lot will block everything that's not 80 or 443.).

____________________
"In other news, Scientists theoretize that CHEESECAKE CHEESECAKE CHEESECAKE." --Blackhole89

blackhole89
Posted on 06-14-10 12:35 PM Link | Quote | ID: 131993


The Guardian
Moloch whose eyes are a thousand blind windows!
Level: 124

Posts: 3147/4196
EXP: 21563909
Next: 272692

Since: 02-19-07
From: Ithaca, NY, US

Last post: 489 days
Last view: 102 days



Technically, the board code very carefully filters things in a manner that https links to the server will be turned into http links when accessed with an http connection and vice versa. Of course, this can't possibly affect posts others make elsewhere - but that is the respective posters' individual problem.

As for the self-signed certificate, I don't exactly feel like paying a three-digit sum to $certificateprovider - and using CAcert would solve nothing as most browsers don't seem to list it as a trusted certifier.

For the PoRA box, I agree about the relative URLs

443 is the standard https port, but that's used for SSH at the moment. Given that I don't rely on port 443 SSH anymore, I probably can change that though if demand is there.

____________________

Mega-Mario
Posted on 06-14-10 03:40 PM Link | Quote | ID: 131995

Spamming from alt accounts.
Level: 81

Posts: 1042/1610
EXP: 4887840
Next: 105009

Since: 09-10-08

Last post: 3607 days
Last view: 3027 days
Posted by blackhole89
Technically, the board code very carefully filters things in a manner that https links to the server will be turned into http links when accessed with an http connection and vice versa. Of course, this can't possibly affect posts others make elsewhere - but that is the respective posters' individual problem.

Then how come the PORA box still has a HTTPS link in HTTP mode? or does it only filter links in posts?

____________________
Kafuka -- ROM hacking
Kuribo64 -- we hack shit

blackhole89
Posted on 06-14-10 05:09 PM Link | Quote | ID: 131999


The Guardian
Moloch whose eyes are a thousand blind windows!
Level: 124

Posts: 3148/4196
EXP: 21563909
Next: 272692

Since: 02-19-07
From: Ithaca, NY, US

Last post: 489 days
Last view: 102 days



The PoRA box is not fed through the post filter, yes.

____________________

chungy
Posted on 06-17-10 02:31 AM Link | Quote | ID: 132051


Rex
Level: 51

Posts: 457/533
EXP: 961743
Next: 52195

Since: 08-23-07
From: Las Vegas

Last post: 4462 days
Last view: 4264 days
Posted by blackhole89
and using CAcert would solve nothing as most browsers don't seem to list it as a trusted certifier.

Does it matter? it's still *some* verification which is better than *none*.

Sure it's not supported by a whole lot of people (majority of Windows browsers don't have the cert, and it certainly doesn't come with Windows), but still clicking past an unverifiable certificate would be the same situation for those users as it is now. if they cared about verifying it against someone, they can.

Ailure
Posted on 06-21-10 12:00 PM Link | Quote | ID: 132241

Hats
Steam Board2 group
Level: 121

Posts: 3567/3965
EXP: 19807559
Next: 249137

Since: 02-19-07
From: Sweden, Skåne

Last post: 3319 days
Last view: 2070 days
I'm all for fixing the port thing at least, three less characters in the URL's and all that.

Even if not for CAcert, what would be the most affordable certificate authority?

____________________
AIM: gamefreak1337, MSN: Emil_sim@spray.se, XMPP: ailure@xmpp.kafuka.org

Main - Help/Suggestions/Bug Reports - The SSL mode New thread | New reply

Acmlmboard 2.1+4δ (2023-01-15)
© 2005-2023 Acmlm, blackhole89, Xkeeper et al.

Page rendered in 0.069 seconds. (325KB of memory used)
MySQL - queries: 59, rows: 79/80, time: 0.059 seconds.