Question: HTTPS enabled?

[blaze0041]

Hopefully a quick question: when was HTTPS enabled on the forum?

My curiosity got piqued when my mobile Chrome browser suddenly wasn't able to use its "Reduce Data Usage" feature here (and of course, it won't work over HTTPS).

I think it's a pretty good move though.

[Makiavel]

Not sure when it was added, but related to it. I tried to register for a few days now on the forums and didn't find the issue until I read this thread.

Turns out that HTTPS made it unable for the image verification to show so I had to go back to "http://forums.animesuki.com/register.php" to register, I'm not sure if the issue is directly related to HTTPS but seems so since I was able to register shortly after removing it.

So if admins could fix that it'd be great.

[NightWish]

Originally Posted by blaze0041

when was HTTPS enabled on the forum?

It has been an option for approximately six months now. The staff have been using it since that time looking for issues. It hasn't been formally announced because it isn't enforced and there may still be issues with certain content. This is partly due to the number of embedded image posts that trigger "partially encrypted" warnings* and some issues on the registration process (which we want to revise anyway) when viewing the secure page.

Originally Posted by Makiavel

Turns out that HTTPS made it unable for the image verification to show...

The forum currently doesn't force you to use HTTPS; the fact you caught an secure link is probably my fault.

We have a test theme/style which is almost identical to the default theme and is normally hidden from users. I enabled it/opened it up to test some https urls as a unregistered user. You probably got caught by that. As you found out, going back to the http page resolved the problem.

As for the verification not working, yes, that is another hurdle we have to work around if we make HTTPS mandatory.


* Edit: You can see the effect of insecure images on this very page by virtue of the screen-shot. How loud your browser warns you about such images I couldn't say. Firefox just changes the padlock icon to a triangle.

[blaze0041]

Thanks for that, so it looks like ran into the HTTPS version by accident...

Another question that popped up in my mind in relation to the HTTPS version: considering the cost of obtaining and maintaining a SSL certificate, will there be any financial impact on forum users?

[NightWish]

Originally Posted by blaze0041

...considering the cost of obtaining and maintaining a SSL certificate, will there be any financial impact on forum users?

Highly unlikely. And if by that you mean will we start charging a subscription fee, no. Of course the final word will be for GHDpro, as the owner, but I'm confident our position on keeping the forum free is unchanged.

That aside, I believe the annual cost of having a certificate (in both time and money) isn't that great compared to the cost of running everything else anyway.

Obviously if you can't "reduce data rate" viewing the forum might end up costing users more directly. That wasn't something I had even considered, so I would be interested to know how many visitors use that sort of feature. Something to look into.

[blaze0041]

Originally Posted by NightWish

Obviously if you can't "reduce data rate" viewing the forum might end up costing users more directly. That wasn't something I had even considered, so I would be interested to know how many visitors use that sort of feature. Something to look into.

I can see this becoming a problem if/when HTTPS is enforced, impacting on visitors who view the forums on their mobile phones, or using another form of Internet service with stricter data limits/slower speeds/a less stable connection. I admit to being browsing the forums frequently from my phone, and I tend to use my mobile plan's data allowance quite aggressively, so having the data compression feature available is huge plus.

As it is though, it does appear any non-HTTPS content can still be compressed by Chrome's "Reduce data usage" feature (like the image I posted in the opening post), and the same applies to Opera's data compression services (it's all pretty much just a proxy service only for non-secure stuff), so perhaps this will only become a bigger problem if somehow all content on the forums (including external content) being delivered was encrypted.

I don't suppose you guys have stats on what browsers people are using here?