HTTPS rolled out

Hi all,

We have implemented end-to-end HTTPS encryption across the entire forum to help protect the forum's data for all users alike. HTTPS is automatic and shouldn't require any interaction on your part. If you try to visit the forum via damnfineshave.com, it should automatically do a 301 redirect and send you to https://damnfineshave.com. If it doesn't, please let me know!

Just a few technical things to point out:

If you post an image from a site that isn't using HTTPS, our system will automatically proxy the image so it's going through secure channels. What that means is if you post an image like so (notice the url is http and NOT https):

Code:

[img]http://i.imgur.com/4NFWnQv.jpg[/img]

it'll automatically get proxied using an https url so it doesn't cause mixed content warnings in the browser. this is how a proxied image url will appear:

Code:

https://images.weserv.nl/?url=i.imgur.com%2F4NFWnQv.jpg

Tapatalk might not be 100% working right now. Tapatalk apparently caches settings for 24-48 hours on their end before new changes are propagated; there is nothing I can do to speed up this process as it's out of my control.


If you have any issues accessing the site, please let me know!

That's great, Andrew, even for us Luddites.

Thanks Andrew!

Excellent, Andrew. I can already see the little lock next to the URL so it seems to be working okay.

Looks good to me. Thanks for going secure.

It's working here in SWNY! Thanks, Andrew!

andrewjs18, this is a great new feature to add to Damn Fine Shave! Was wondering about a couple of things, and since I’m guessing leefish might be able to also answer, I’m tagging her, as well.

I’m just curious about image links. If users post image links that are non-https, will you have to store those images in a separate depository or server? (I was wondering because of that “images.weserv.nl” link you displayed.)

I use imgur.com to store any images that I link to DFS. Oddly enough, their main page is https, yet when you copy an image link, it’s just http. However, I just did a test (with a single picture), and it seems that if I add the “s” to “http” manually, the link will still work.

Mainly I’m just wondering what the best solution is for DFS moving forward. If my findings truly work (converting the link manually), then those of us who use imgur could continue to do so and possibly spare you some server load — that is, if weserv.nl adds any overhead to the operation of DFS.

andrewjs18, this is a great new feature to add to Damn Fine Shave! Was wondering about a couple of things, and since I’m guessing leefish might be able to also answer, I’m tagging her, as well.

I’m just curious about image links. If users post image links that are non-https, will you have to store those images in a separate depository or server? (I was wondering because of that “images.weserv.nl” link you displayed.)

I use imgur.com to store any images that I link to DFS. Oddly enough, their main page is https, yet when you copy an image link, it’s just http. However, I just did a test (with a single picture), and it seems that if I add the “s” to “http” manually, the link will still work.

Mainly I’m just wondering what the best solution is for DFS moving forward. If my findings truly work (converting the link manually), then those of us who use imgur could continue to do so and possibly spare you some server load — that is, if weserv.nl adds any overhead to the operation of DFS.

no, weserv.nl is a 3rd party service that is available for free. they run their services through cloudflare so all of the images that are proxied using their site are cached around the world in over 80 cloudflare datacenters. that's why I decide to use them - put the load on their servers.

I'm not too sure why imgur doesn't force https across their entire site. maybe they don't want the extra load from running https, but I'm not certain. I know if you use the imgur tool on this site, it automatically forces it over https.

no, weserv.nl is a 3rd party service that is available for free.  they run their services through cloudflare so all of the images that are proxied using their site are cached around the world in over 80 cloudflare datacenters.   that's why I decide to use them - put the load on their servers.

I'm not too sure why imgur doesn't force https across their entire site.  maybe they don't want the extra load from running https, but I'm not certain.  I know if you use the imgur tool on this site, it automatically forces it over https.

Thanks, Andrew, it’s nice to know. That Cloudfare server map is quite impressive, by the way.

And yes, it’s strange that imgur runs a mixed bag, when it comes to https. If I post a link from them manually, I’ll try to remember to add the ‘s’ myself. It’s good that DFS’s tool forces it automatically.

no, weserv.nl is a 3rd party service that is available for free.  they run their services through cloudflare so all of the images that are proxied using their site are cached around the world in over 80 cloudflare datacenters.   that's why I decide to use them - put the load on their servers.

I'm not too sure why imgur doesn't force https across their entire site.  maybe they don't want the extra load from running https, but I'm not certain.  I know if you use the imgur tool on this site, it automatically forces it over https.

Thanks, Andrew, it’s nice to know. That Cloudfare server map is quite impressive, by the way.

And yes, it’s strange that imgur runs a mixed bag, when it comes to https. If I post a link from them manually, I’ll try to remember to add the ‘s’ myself. It’s good that DFS’s tool forces it automatically.

no biggie. this is why it took me longer to roll out https than expected. in order to avoid the mixed content warnings about the site serving non-https content (images, mostly), I had to make sure that everything automatically got proxied through an https server or app that wasn't being served from a secure site to begin with.