+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+--- Thread: [News] HTTPS Support Added (/showthread.php?tid=5424059)
* - Rubixa - Oct 4, 2016
(Oct 4, 2016 10:37 AM)Neeeeeeeeeel.- Wrote: If all the users changes their signatures/avatars/post images to HTTPS, then you will see the green padlock.
If just one referenced resource is called though HTTP protocol, you will see the "mixed-content"/broken SSL padlock.
Also, if someone changed their browser settings to do not allow mixed-content he will get a security warning (just like the one displayed when the certificated is expired). Some years ago this setting was default in most browsers.
Thanks for that mate, appreciate it.
* - Omniscient - Oct 4, 2016
Quote:HTTPS sites receive a small ranking boost, but don't expect a visible change. Google uses HTTPS as a positive ranking signal. This signal is one amongst many others, and currently carries less weight than high-quality site content; you should not expect a major SEO advantage for moving to HTTPS in the short term. In the longer term, Google may increase the strength of the HTTPS boost.
No lie...doing this because of the SEO benefits. Zero fucks given about MiTM. SEO is everything. Site owners who spamvertise forums are 100% idiots.
Quote:everything is taking an extra second
And the load is maybe 1/2 to 1 second delay. We were perfect blazing at 300ms per page load. And that's the price you'll all have to pay for saving 0 accounts from MiTM.
https://i.imgur.com/KOLV1kA.png
You may get showthread and profile pages with broken security locks due to mixed content. I can't fix that actually without more in-depth changes to HF.
My choices would be to require upload avatars and get rid of avatar URLs. I could also force urls to places like imgur and others that support https. But with signatures that's more difficult. I suppose I could view my plugins I already run the effect signatures and see if I can make it enforce https. Ugh...
But then again any img tags in threads aren't going to be HTTPS. The Cloudflare setting helps a lot. Does some of the work for me automatically.
https://hackforums.net/showthread.php?tid=5422429
This user has an image in signature which will break the HTTPS.
https://hackforums.net/member.php?action=profile&uid=2219785
Their image is on a site with no HTTPS support.
http://715.wf/sharex/images/gif/AS413.gif
That member has almost 10k posts. Any thread page you view with his sig will break full HTTPS security. Even worse if you have your browser set to strict settings the pages may not load at all. That is the real problem with this. The HTTPS protocol should never have required CSS and images be part of the protocol.
* - Bluffer - Oct 4, 2016
Been a discussion for a long time and I suppose as long as users aren't having any issues with it than there's nothing bad about having https.
Great job Omni!
* - ZuGgY - Oct 4, 2016
Never expected this to be implemented. Thanks for thr update!
* - $lick - Oct 4, 2016
(Oct 4, 2016 10:42 AM)Omniscient Wrote: No lie...doing this because of the SEO benefits. Zero fucks given about MiTM. SEO is everything. Site owners who spamvertise forums are 100% idiots.
I use https on all my sites that have no inputs or anything worth stealing, it's just better for SEO and looks kinda nifty in the url bar.
* - deject - Oct 4, 2016
(Oct 4, 2016 10:42 AM)Omniscient Wrote: No lie...doing this because of the SEO benefits. Zero fucks given about MiTM. SEO is everything. Site owners who spamvertise forums are 100% idiots.
And the load is maybe 1/2 to 1 second delay. We were perfect blazing at 300ms per page load. And that's the price you'll all have to pay for saving 0 accounts from MiTM.
https://i.imgur.com/KOLV1kA.png
You may get showthread and profile pages with broken security locks due to mixed content. I can't fix that actually without more in-depth changes to HF.
My choices would be to require upload avatars and get rid of avatar URLs. I could also force urls to places like imgur and others that support https. But with signatures that's more difficult. I suppose I could view my plugins I already run the effect signatures and see if I can make it enforce https. Ugh...
But then again any img tags in threads aren't going to be HTTPS. The Cloudflare setting helps a lot. Does some of the work for me automatically.
https://hackforums.net/showthread.php?tid=5422429
This user has an image in signature which will break the HTTPS.
https://hackforums.net/member.php?action=profile&uid=2219785
Their image is on a site with no HTTPS support.
http://715.wf/sharex/images/gif/AS413.gif
That member has almost 10k posts. Any thread page you view with his sig will break full HTTPS security. Even worse if you have your browser set to strict settings the pages may not load at all. That is the real problem with this. The HTTPS protocol should never have required CSS and images be part of the protocol.
Gotcha! Thanks for the information.
* - Monostable555 - Oct 4, 2016
Thanks Omni for adding it, it doesn’t really matter to me if its HTTPS or HTTP I highly doubt that I’ll get MITMed, be thanks never the less!
So, go celebrate or kiss ass or complain...whatever you do. It's done.
IL definitively kiss ass and then celebrate!
* - Jаson - Oct 4, 2016
(Oct 4, 2016 10:10 AM)Omniscient Wrote: I already feel like pages are taking an extra second to load.
Yes, They are.
* - Tommy Chong- - Oct 4, 2016
(Oct 4, 2016 10:42 AM)Omniscient Wrote: And the load is maybe 1/2 to 1 second delay. We were perfect blazing at 300ms per page load. And that's the price you'll all have to pay for saving 0 accounts from MiTM.
I lol'd at this
I've seen too many people whining about SSL while the difference is minimal, even close to none. 🤦♂
Now let's enjoy the people complain about the minimal longer loading speed.
* - BLURRYFΛCE - Oct 4, 2016
Thanks Omnomnoms. Far prefer HTTPS over HTTP, not due to the security risks involved but privacy risks regarding e.g. my ISP or my government snooping on me (not to mention the Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC) Been raided once before so you never know. Not implying that Hack Forums should be used for any illegal activities of course, but would bet my sweet ass there's a lot of unfavorable things being said and/or shared in private messages, etc.
* - SoulZeh - Oct 4, 2016
Well we can all wait for threads being posted about "HF loading too slow"
"Getting an error while accessing HF"
All them boring ass stuff, but yea. Good job.
* - Steve - Oct 4, 2016
Thanks for the implementation, however it now seems the Hack Forums Utility Pack is not working for me. This userscript provided a lot of extra features like "Bans" "Negs" and "HFUP options" links in this bar which are not there anymore:
Spoiler (Click to View)
![[Image: 8tQPxRP.png]](https://i.imgur.com/8tQPxRP.png)
In contrast, the other userscript I use (Prestige Calculator) does work:
Spoiler (Click to View)
![[Image: F0Z6QUU.png]](https://i.imgur.com/F0Z6QUU.png)
Both are enabled, but I think the difference is that the Prestige Calculator does not make any page requests while the Utility Pack does...? I'd have to ask Xerotic.
* - Omniscient - Oct 4, 2016
I don't support userscripts. You should disable them and contact the author.
* - Jаson - Oct 4, 2016
For the userscripts you'll have to add http*://hackforums.net/*
* - Neeeeeeeeeel.- - Oct 4, 2016
Omni, I've found some HF resources that are not loaded with HTTPS at User CP.
![[Image: nwnXSTa.png]](https://i.imgur.com/nwnXSTa.png)
As you can see, each resource from images/modern_bl/usercp/* uses HTTP protocol.
EDIT: NVM, it was just my cache.... everything is working properly.