Could the DSI forum redirect to HTTPS please?

[Gerry Havinga]

I am not sure if this is the right place for this request, but I really would like you guys to "force" access to this forum to using encryption (HTTPS/TLS). An automatic re-direct would do I presume.

At the moment, you need to explicit specify "https://" ;-). Thanks in advance.

[chysn]

My concern with this would be that there are still people out there using browsers that don't support SNI, and an automatic redirect would shut them out. For security-critical enterprise situations, forcing https makes sense. But for a web forum, giving users the option to use https or not is the better choice. For those who want to use https, it's available here, and they can bookmark the https URL.

[Shaw]

...But for a web forum, giving users the option to use https or not is the better choice. For those who want to use https, it's available here, and they can bookmark the https URL.

Phew... common sense prevailed on that one!


Damn.

[Gerry Havinga]

My concern with this would be that there are still people out there using browsers that don't support SNI, and an automatic redirect would shut them out. For security-critical enterprise situations, forcing https makes sense. But for a web forum, giving users the option to use https or not is the better choice. For those who want to use https, it's available here, and they can bookmark the https URL.

Cannot agree with you here ;-). Don't forget there are also other reasons why encrypting traffic to the site is advantageous. Google, for example, is indexing sites that offer (only) HTTPS with higher rankings. For end users there should not be any difference, they shouldn't really notice (except for the safety icon to the left of the browser URL line). Users of the site will immediately notice if something is wrong with the site (invalid certificate, site highjacked, etc.) by safety warnings all modern browsers provide.

Also the site doesn't work very well using HTTPS (using Chrome for Windows and Linux). The login button on the main page is not active when loading the page via HTTPS. The login menu at the top of the page does work though. When logged in it is not possible to post, the action menu does not work and the "+" button at the bottom of the page neither. Actually the forum is not really usable when browsing using HTTPS, at least not for Chrome users I haven't tested other browsers.
 

[natrixgli]

there are still people out there using browsers that don't support SNI

There is no reason to be using an outdated browser for casual web surfing. Web sites should not cater to people who can't be bothered to keep up with the times.

[chysn]

Also the site doesn't work very well using HTTPS (using Chrome for Windows and Linux). The login button on the main page is not active when loading the page via HTTPS. The login menu at the top of the page does work though. When logged in it is not possible to post, the action menu does not work and the "+" button at the bottom of the page neither. Actually the forum is not really usable when browsing using HTTPS, at least not for Chrome users I haven't tested other browsers.

You're right about this. There's a mixed-content block, which can be easily fixed by using a protocol-relative URL. Hopefully they'll do something about that.

[chysn]

Also the site doesn't work very well using HTTPS (using Chrome for Windows and Linux). The login button on the main page is not active when loading the page via HTTPS. The login menu at the top of the page does work though. When logged in it is not possible to post, the action menu does not work and the "+" button at the bottom of the page neither. Actually the forum is not really usable when browsing using HTTPS, at least not for Chrome users I haven't tested other browsers.

You're right about this. There's a mixed-content block, which can be easily fixed by using a protocol-relative URL. Hopefully they'll do something about that.

They've fixed this. The site works with https now.

[Gerry Havinga]

They've fixed this. The site works with https now.

Yes indeed they have, wow what a fast response, impressive. I have logged in as normal, using HTTPS and am typing this now having a session open using HTTPS.

Thanks guys, good and fast work.