The Canadian Guitar Forum banner

21 - 27 of 27 Posts

·
Premium Member
Joined
·
1,206 Posts
Here is what I am offering the VS core IT team instead of the approach they've taken here:

May I not so humbly suggest a different approach that you need to take and rapidly. You CANNOT re-write functional URL into non-functional URLs, that's simply a non-starter. But, you can detect non-SSL URLs and offer a redirect off the the forum so that user's get to deal with the "insecure" non-SSL sites themselves at their own choice. That is, if a URL is properly SSL, let it behave normally on the forum; if it is not, rather than changing the URL into oblivion, a) don't allow non-SSL site "preview" of any sort, and b) offer users "do you wish to open the insecure page in a separate window" dialog.
 

·
Registered
Joined
·
4,556 Posts
Guys....just google Secure Socket Layer. It's an old security technology that a vast majority of sites use for all sorts of reasons. SSL is all tied into Certificates (CA) that are required on the specific ports used on secure transactions and such. What I just mentioned is extremely simplistic and pared down because no one really has to know this unless you're Administering a network either publicly or privately. So take it for what it is.

@LexxM3 , thanks a bunch. I 've been out of the game for too long to even remember how to setup an AD in an MS environment....never mind the tech you're talking about...haha.
 

·
Administrator
Joined
·
200 Posts
Talked with techs. We don't force the non-sll links to be HTTPS as a way of protecting you guys, but as a way to protect the site. With how our SSL works, even having the HTTP links on the site invalidates our own security certificate. Having that "are you sure?" message wouldn't be a sufficient block in the communication to get around that hurdle.

Kevin
 

·
Premium Member
Joined
·
17,019 Posts
Discussion Starter #25
@GCAdmin1 I don't understand the specifics of this but I appreciate all that is being done to eliminate the frustration for the user.

@LexxM3 Thanks for all the time and energy you have put into helping with this.
 

·
Premium Member
Joined
·
1,206 Posts
Talked with techs. We don't force the non-sll links to be HTTPS as a way of protecting you guys, but as a way to protect the site. With how our SSL works, even having the HTTP links on the site invalidates our own security certificate. Having that "are you sure?" message wouldn't be a sufficient block in the communication to get around that hurdle.

Kevin
Thanks for the info. I don’t run your systems so I can’t comment on that level of detail with any precision, but with all due respect, the approach you’ve taken is wrong simply because it breaks the forum and it breaks the internet. Focus on security is a nobble cause, but not “at all cost” when it kills the baby in the bath. You need to go back to the drawing board, as “simple” as that.
 
21 - 27 of 27 Posts
Top