Should forum.defcon.org be SSL only?

[Dark Tangent]

Re: Should forum.defcon.org be SSL only?

Thanks for the report!

Updated in forums and pics. It may take a while for cached data to stopped being cached with this content, but a forced refresh should fix that.

Speaking of which I just fixed an http 'connection' header problem on pics and implemented some filtering on www. Please let us know if anything is acting wrong.

[TheCotMan]

Re: Should forum.defcon.org be SSL only?

extremely minor point - there's a typo on the http warning page:
"(We will ask your browser to forward you to that same link in 30 seconds, but you can select that link now to skip the 30 secon wait.)"

the 'd' got dropped from second. (I 'spose that's what I get for dropping the 's' from https)

Thanks for the report!

Updated in forums and pics. It may take a while for cached data to stopped being cached with this content, but a forced refresh should fix that.

[YenTheFirst]

Re: Should forum.defcon.org be SSL only?

extremely minor point - there's a typo on the http warning page:
"(We will ask your browser to forward you to that same link in 30 seconds, but you can select that link now to skip the 30 secon wait.)"

the 'd' got dropped from second. (I 'spose that's what I get for dropping the 's' from https)

[astcell]

Re: Should forum.defcon.org be SSL only?

Do overseas visitors have access to 128 bit encryption now? I recall at one time all they could get was 56 bit.

[TheCotMan]

Re: Should forum.defcon.org be SSL only?

Looks like SSL wins.. now to get ready to make some changes. I think the cookies that are getting set by the forums are not setting the "secure" bit.

Ok. I will look to move over to exclusively support https for pics and forum. This will probably happen after 4:00pm pacific time today, or late on the 25th.

[Dark Tangent]

Re: Should forum.defcon.org be SSL only?

Looks like SSL wins.. now to get ready to make some changes. I think the cookies that are getting set by the forums are not setting the "secure" bit.

[Greyhatter]

Re: Should forum.defcon.org be SSL only?

HTTPS= Your right to your privacy and your freedom at this time only until squash. When that is broken your dongle will be blowin' in the breeze (plz. no PP&M references).

[Dark Tangent]

Re: Should forum.defcon.org be SSL only?

Get your vote in.. only a week remains!

[Greyhatter]

Re: Should forum.defcon.org be SSL only?

Visiting our site is encrypted, login is encrypted, but after that some browsers show our site not fully encrypted after login, but then I'm not buying anything here. Mods want to know more ask me privately.

[Dark Tangent]

Re: Should forum.defcon.org be SSL only?

OK, looks like it is leaning SSL only...

[KinoEye]

Re: Should forum.defcon.org be SSL only?

First you add blog software, and the next thing you know, we turn into myspace. :-P~~

Actually I would prefer we turn into Utherverse as posting porn is against the Myspace TOS.

That said I vote yes on HTTPS.

[TheCotMan]

Re: Should forum.defcon.org be SSL only?

The way we do redirection from http to https is a clever kludge Cot came up with...

Actually, I think that the kludge I created ensures that links to any post or server with defcon.org remains https even if the poster posts it as http, when the web browser visiting the site is visiting with https.
In a similar way, when a user is visiting with http, all defcon.org links to any defcon.org servers appear as http even if they were https.

This helps to make sure people desiring https get https to defcon.org links, and people that can't do https, only get http links from the forums to defcon.org domains.

This is the function that will be lost.

Now pics.defcon.org is another story. Without this kludge, that software will only generate links to http: no matter how you log in. Eventually, any https session will become an http session without this kludge. If we change to only offer https, then the new default for it can become https: instead of http:

HTH,
-Cot

Wave of /.edness comes over me.

First Vote!

Stop it! Don't let that spread here! My eyes! My eyes! My brain! Wait. My brain no longer hurts, and I have a strange desire to go out and buy lottery tickets, and watch lots of TV. Why did I want to go to the library anyway? ;-)

See... this is what happens. First you add blog software, and the next thing you know, we turn into myspace. :-P~~

No soup for you!

[streaker69]

Re: Should forum.defcon.org be SSL only?

Wave of /.edness comes over me.

First Vote!

[Dark Tangent]

Hey everyone, I'd like everyone's input on switching forum.defcon.org over to ssl only. Brief background:

The way we do redirection from http to https is a clever kludge Cot came up with, but it prevents us from using http compression, which would speed things up for everyone. Now that mobile devices have supported http compression for years we may as well take advantage of it, not to mention it would be like getting extra free capacity.

With ssl only some of the xss and related attacks would be more difficult and MITM concerns would almost vanish.

The downside is some people might not be able to log in through proxies (I can over tor, though), at free WiFi locations, etc.

So here is a poll! Comment here and vote too!