Go Back   Home > Forums > >
Home Forums Rules Articles diyAudio Store Blogs Gallery Wiki Register Donations FAQ Calendar Search Today's Posts Mark Forums Read

Site Announcements Updates to the forums will be displayed here.

Site moving to HTTPS
Site moving to HTTPS
Please consider donating to help us continue to serve you.

Ads on/off / Custom Title / More PMs / More album space / Advanced printing & mass image saving
Reply
 
Thread Tools Search this Thread
Old 12th September 2018, 09:57 PM   #31
user510 is offline user510
diyAudio Member
 
user510's Avatar
 
Join Date: Jan 2003
Location: Raymond, Wa USA
Just a sketch - Vinyl Engine

Fwiw I'm using Firefox latest version. When I click on the links I posted above I do see similar warning messages as posted above. However when I actually visit those sites and view the links there, there are no such warnings. I suspect that the warning messages are being generated here and not anywhere else.

For instance if you visit this site:
The Analog Dept.
you will not see any warnings.

-Steve
  Reply With Quote
Old 12th September 2018, 09:59 PM   #32
user510 is offline user510
diyAudio Member
 
user510's Avatar
 
Join Date: Jan 2003
Location: Raymond, Wa USA
Quote:
Originally Posted by Jason View Post
If you could post a link to an HTTPS Audio Asylum page with one of your HTTP images on it, I'd be curious to see how they handle it. They will either be proxying it via a HTTP to HTTPS proxy (as we are), or just letting the browser throw a mixed content warning (which isn't good, and something we aren't going to be doing).
Listening at The Analog Dept. - user510 - Vinyl Asylum
  Reply With Quote
Old 12th September 2018, 10:26 PM   #33
Jason is offline Jason  Australia
:)
diyAudio Administrator
 
Jason's Avatar
 
Join Date: Oct 2000
Location: Melbourne
Site moving to HTTPS
That page throws 2 mixed content warnings (one warning, for your JPG and one fatal, for an external script). This page won't get a padlock symbol, due to this.

Now, why your image is fatal on diyAudio and not a warning, I'm not sure just now. It's possibly because of the highslide script which is loading the image via a script, which is a worse category of issue. But you can be sure of one thing - the situation won't get better over time as browsers ratchet security ever tighter.

Actually I think the problem is on AA, the HTTP version is being loaded. The SSL version isn't, so the cert isn't being checked. On diyAudio, the HTTPS version is attempted, and since the cert is invalid, it's failing. The solution is to get a valid cert, which is free these days: Let's Encrypt - Free SSL/TLS Certificates.

However don't let people tell you "oh Let's Encrypt is so easy for everyone"... yes, for most it's easy. For some setups like diyAudio's, it was a PITA to get working. There are plenty of keyboard jockeys with a Wordpress site that think they know everything.

Long story short - it's the future, and we need to move on, and you need to get a valid cert. Maybe try using Cloudflare (free) for your DNS, use their caching services (free) to take load off your server and give you a SSL proxy (free), and you won't have to do a thing. They even have a SSL proxy mode where they ignore the cert validity of the origin (your site) which would work great for you without any changes at all.

Last edited by Jason; 12th September 2018 at 10:34 PM.
  Reply With Quote
Old 12th September 2018, 10:32 PM   #34
GASCo is offline GASCo  United States
diyAudio Member
 
GASCo's Avatar
 
Join Date: Jan 2018
Location: Denver, CO
Site moving to HTTPS
Working fine again on tapatalk
  Reply With Quote
Old 12th September 2018, 10:33 PM   #35
Jason is offline Jason  Australia
:)
diyAudio Administrator
 
Jason's Avatar
 
Join Date: Oct 2000
Location: Melbourne
Site moving to HTTPS
Quote:
Originally Posted by GASCo View Post
Working fine again on tapatalk
Great. I just fixed that.
  Reply With Quote
Old 12th September 2018, 10:34 PM   #36
Bigun is offline Bigun  Canada
diyAudio Member
 
Bigun's Avatar
 
Join Date: Jan 2009
Location: Waterloo, ON or Herefordshire UK
Site moving to HTTPS
did something change? - didn't even notice ! using Safari all looks good.
__________________
"The test of the machine is the satisfaction it gives you. There isn't any other test. If the machine produces tranquility it's right. If it disturbs you it's wrong until either the machine or your mind is changed." Robert M Pirsig.
  Reply With Quote
Old 12th September 2018, 10:36 PM   #37
Jason is offline Jason  Australia
:)
diyAudio Administrator
 
Jason's Avatar
 
Join Date: Oct 2000
Location: Melbourne
Site moving to HTTPS
Quote:
Originally Posted by Bigun View Post
did something change? - didn't even notice ! using Safari all looks good.
Sadly, in Chrome, we don't even get a green padlock anymore. It's just a grey on grey padlock symbol. HTTPS is now considered "normal" and HTTPS is considered "abnormal".
  Reply With Quote
Old 12th September 2018, 11:00 PM   #38
user510 is offline user510
diyAudio Member
 
user510's Avatar
 
Join Date: Jan 2003
Location: Raymond, Wa USA
Quote:
Originally Posted by Jason View Post
That page throws 2 mixed content warnings (one warning, for your JPG and one fatal, for an external script). This page won't get a padlock symbol, due to this.

Now, why your image is fatal on diyAudio and not a warning, I'm not sure just now. It's possibly because of the highslide script which is loading the image via a script, which is a worse category of issue. But you can be sure of one thing - the situation won't get better over time as browsers ratchet security ever tighter.

Actually I think the problem is on AA, the HTTP version is being loaded. The SSL version isn't, so the cert isn't being checked. On diyAudio, the HTTPS version is attempted, and since the cert is invalid, it's failing. The solution is to get a valid cert, which is free these days: Let's Encrypt - Free SSL/TLS Certificates.

However don't let people tell you "oh Let's Encrypt is so easy for everyone"... yes, for most it's easy. For some setups like diyAudio's, it was a PITA to get working. There are plenty of keyboard jockeys with a Wordpress site that think they know everything.

Long story short - it's the future, and we need to move on, and you need to get a valid cert. Maybe try using Cloudflare (free) for your DNS, use their caching services (free) to take load off your server and give you a SSL proxy (free), and you won't have to do a thing. They even have a SSL proxy mode where they ignore the cert validity of the origin (your site) which would work great for you without any changes at all.
I just had a chat with tech support at my web host. They inform me that in order to get an SSL working I'll need a dedicated IP addy and that will be at additional cost.

I agree re: "It's the future". In the mean time I suppose my images just won't load on this forum. Everywhere else, so far, they do.

I'll do something to modernize.
-Steve
  Reply With Quote
Old 12th September 2018, 11:06 PM   #39
Jason is offline Jason  Australia
:)
diyAudio Administrator
 
Jason's Avatar
 
Join Date: Oct 2000
Location: Melbourne
Site moving to HTTPS
I suspect you don't need to do anything - just sign up for Cloudflare, have them manage your DNS, and activate their SSL and caching. Zero expense. Buy you a beer if you can't do it.

Simple Secure Socket Layer (SSL)/TLS Encryption | Cloudflare

Quote:
Flexible SSL
Flexible SSL encrypts traffic from Cloudflare to end users of your website, but not from Cloudflare to your origin server. This is the easiest way to enable HTTPS because it doesn’t require installing an SSL certificate on your origin. While not as secure as the other options, Flexible SSL does protect your visitors from a large class of threats including public WiFi snooping and ad injection over HTTP.
Quote:
Opportunistic Encryption
Opportunistic Encryption provides HTTP-only domains that can't upgrade to HTTPS, due to mixed content or other legacy issues, the benefits of encryption and web optimization features only available using TLS without changing a single line of code.
However as I know all too well "one size doesn't fit all", so YMMV I'll still buy you that beer though!

Last edited by Jason; 12th September 2018 at 11:15 PM.
  Reply With Quote
Old 12th September 2018, 11:09 PM   #40
Pano is offline Pano  United States
diyAudio Moderator
 
Pano's Avatar
 
Join Date: Oct 2004
Location: SW Florida
Site moving to HTTPS
Still all working fine for me on latest Firefox both Win10 and OSX. Will try mobile
  Reply With Quote

Reply


Site moving to HTTPSHide this!Advertise here!
Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Redirect loops between HTTP and HTTPS versions of diyAudio on Chrome and Firefox Jason Forum Problems 8 9th August 2017 11:59 AM
Moving on... to the music jfetter Everything Else 1 5th November 2016 01:29 AM
Moving day jackinnj The Lounge 12 26th January 2016 01:32 PM
https://www.diyaudio.com/ doesn't work? freax Forum Problems 5 29th December 2014 07:51 AM
Moving my post? Dominique Forum Problems 2 7th March 2007 12:10 PM


New To Site? Need Help?

All times are GMT. The time now is 08:28 AM.


Search Engine Optimisation provided by DragonByte SEO (Pro) - vBulletin Mods & Addons Copyright © 2019 DragonByte Technologies Ltd.
Resources saved on this page: MySQL 14.29%
vBulletin Optimisation provided by vB Optimise (Pro) - vBulletin Mods & Addons Copyright © 2019 DragonByte Technologies Ltd.
Copyright ©1999-2019 diyAudio
Wiki