DEFCON Forums supports SSL

[TheCotMan]

Re: DEFCON Forums supports SSL

... diff -u? attaaack.. of the killer rewrite!

Heh heh. No need to patch code. :-)

Thinking before doing.

We visit the admincp, and change the default url from http to https
Done.

Well, not quite done. Next, we look for bugs related to that change. May not be any. The dynamic rewrite code I added before, may iron out any bugs that we might have otherwise had.

[converge]

Re: DEFCON Forums supports SSL

Well, not quite done. Next, we look for bugs related to that change. May not be any. The dynamic rewrite code I added before, may iron out any bugs that we might have otherwise had.

Just made the change, looking for bugs. Thusfar standard http appears to be in tact.

[TheCotMan]

Re: DEFCON Forums supports SSL

Email Validation, Welcome email, and auto-protmotion email (when users can post replies, or new threads, etc.) have had their text altered to include https links first, followed by http links for links to rules, policies, validation of email address and new forum account.

I can verify that notice of a new PM offers links as https.

Email notices of followup to threads a user is subscribed to receive updates should also work.

Ok. What else?

[DaKahuna]

Re: DEFCON Forums supports SSL

Looks even better now. I use Sage with Firefox and now all the pages are coming up HTTPS without me having to change.

Thanks guys! Catch me at the Forum Meet this year and I'll buy you both a beer!

[TheCotMan]

Re: DEFCON Forums supports SSL

Left to do:
Add support to include that image with that nasty-mean-cruel-informative message to http users letting them know https is available, while letting https users know they are using https.

I spoke with converge about this. We'll use the defcon image/banner with altered text as a link to change encryption.

Expect this to be finished today-- probably in the next hour.

Add support for auto-redirect to https from http connections based on netmask connection ranges. (If we want this to work, we will need to know the public range of IP that unroutable NAT-ed IP will appear as to the public. By making this easy to change, I could change this from con, allowing it to remain a secret until it is needed.)

Yeah.... Done. We don't even need to restart the web server to make these changes.

We can now specify a network/subnet including 0.0.0.0/0 to make everyone go https if we really want to. (We don't want to. If we wanted to do this, a server-based forward for all http->https would make much more sense and work better.)

[converge]

Re: DEFCON Forums supports SSL

I'm going to hold off on the https test and autoredirect to force a move if the prot works ... want to see that all these changes take well.. we can keep an eye on stats related to folks using http vs https .. after a week or two of burning this, we can decide if we want to move forward with a forced initial https page if supported.

[TheCotMan]

Re: DEFCON Forums supports SSL

The single banner image has been split into 2 images. The original DEF CON banner is linked to the main index. The image to the right does what it says it does.