HTTPS issues

cros13

Hi,

When accessing via HTTPS there are a ton of insecure elements loaded because http:// is being specified in their URL.

With more and more paranoid wackos like me using HTTPS Everywhere and similar extensions, it would be nice to get the worst of these fixed. And it's not the most time consuming job ever.

On the frontpage:
http://announcements.boards.ie.s3.amazonaws.com/default.png
http://b-static.net/www/i/ajax-spinner.gif

On the forum index:
As above plus:
Basically everything from http://b-static.net/vbulletin/images/custom/
http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js (just use it like this without the leading http: <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js" ></script>)

Looking at a post:
As above plus:
a few scripts from http://b-static.net/javascript/ and http://b-static.net/modutils

Spear

The site entire isn't meant to be, and isn't enabled to be used through HTTPS. This isn't a bug, and is a known limitation.

cros13

Then they should either rewrite HTTPS to HTTP for the sections of the site that are not ready or spend the ~5-6 hours of developer time changing static URLs and correcting minor issues (even for boards heavily modified vbulletin it's easy, just sort the default theme first) and the few infrastructure modifications (which I figure are mostly done given the load balancer is configured properly and most of the site actually works through HTTPS already).

Not a huge job. If I wasn't so busy with my paid work I'd offer to hop around the corner next morning I'm in TOG and do it gratis.

cros13

My apologies. My tone might have been a bit off. I blame the flu I've been fighting off.

I know it's not the most pressing matter that the developers have to deal with at the moment.
It just seems like one of those things that can fall off the task list easily.

I know HTTPS would have implications in terms of infrastructure sizing and fixing whatever bugs show up, but at least some of the issues can be fixed very easily and can be done in isolation without creating more work (e.g. the jquery example I gave).

Creamy Goodness

Having http a on for the sake of it doesn't make it any more secure. Afaik all the pages on boards that need to be https are so.

digitalninja

reporting same issues, firefox on mac.