SSL in Debian Forums

Have something to say about forums.debian.net itself?

Re: SSL in Debian Forums

Postby dotlj » 2015-08-03 11:41

User avatar
dotlj
 
Posts: 511
Joined: 2009-12-25 17:21

Re: SSL in Debian Forums

Postby millpond » 2015-08-14 00:33

Personally, I would love to have the NSA listen to what I have to say about systemd.
millpond
 
Posts: 582
Joined: 2014-06-25 04:56

Re: SSL in Debian Forums

Postby Chiefahol » 2016-02-22 03:07

+1

You know mint just got their website completely owned. :shock:

It's probably time to use HTTPS on the main website and forums.

What's the delay about? :mrgreen:
Chiefahol
 
Posts: 30
Joined: 2015-08-27 11:39

Re: SSL in Debian Forums

Postby alderaan » 2016-02-22 16:29



+1


levlaz wrote:Once this is live we should just use it. It costs nothing and works in any browser.

https://letsencrypt.org/


It is in beta since 2015-12-03:
https://letsencrypt.org/2015/12/03/ente ... -beta.html

The Debian package migrated to testing just a few days ago:
https://tracker.debian.org/pkg/python-letsencrypt
alderaan
 
Posts: 90
Joined: 2013-07-25 20:20

Re: SSL in Debian Forums

Postby Crewp » 2016-02-29 01:13

i vote yes, for SSL for this forum.
User avatar
Crewp
 
Posts: 59
Joined: 2013-08-02 18:25

Re: SSL in Debian Forums

Postby edbarx » 2016-02-29 23:43

Since this is a public forum where everyone can blather whatever nonsense comes to one's mind, I see no benifits in using SSL. The only 'benefits' I see, are higher load on the servers as these will also have to deal with encryption and decryption.

Vote: NO.
Debian == { > 30, 000 packages }; Debian != systemd
The worst infection of all, is a false sense of security!
It is hard to get away from CLI tools.
User avatar
edbarx
 
Posts: 5383
Joined: 2007-07-18 06:19
Location: 35° 50 N, 14 º 35 E

Re: SSL in Debian Forums

Postby cpoakes » 2016-03-02 01:09

Sarge-in-charge wrote:...This is so wrong on many levels.

No HTTP traffic should be sent on the clear. Period. That's just the way it is in the post-Snowden era.

Really? Show me the contents of your apt sources.list. NOTHING coming from the package archives is run through https because of the huge encryption overhead; security is managed by other means. ISOs downloaded from most sources are not encrypted for the same reason. And that video or audio stream arriving at your browser is also generally not encrypted (even if you started it from an HTTPS secured web page).

HTTPS is NOT free. Every frakin' byte that arrives and departs has to be individually encrypted. While generally imposing little noticeable overhead on the client-side ("browser"), there is an added burden on the server side that can require server upgrades to meet volume demands.

BTW, when it comes to discussing computers, software, and protocols "never say never" is generally good policy. There are enough corner cases to prove most "never do this" scenarios wrong.
User avatar
cpoakes
 
Posts: 94
Joined: 2015-03-29 04:54

Re: SSL in Debian Forums

Postby tomazzi » 2016-03-21 22:22

wizard10000 wrote:Only reason I can think of is sending passwords in plain text.


Chiefahol wrote:You know mint just got their website completely owned. :shock:

It's probably time to use HTTPS on the main website and forums.


cpoakes wrote:
Sarge-in-charge wrote:...This is so wrong on many levels.

No HTTP traffic should be sent on the clear. Period. That's just the way it is in the post-Snowden era.

Really? Show me the contents of your apt sources.list. NOTHING coming from the package archives is run through https because of the huge encryption overhead; security is managed by other means. ISOs downloaded from most sources are not encrypted for the same reason. And that video or audio stream arriving at your browser is also generally not encrypted (even if you started it from an HTTPS secured web page).

HTTPS is NOT free. Every frakin' byte that arrives and departs has to be individually encrypted. While generally imposing little noticeable overhead on the client-side ("browser"), there is an added burden on the server side that can require server upgrades to meet volume demands.
...


Of course encryption is costly on the server side, but let's face the truth: http://forums.debian.net is not the most frequently visited web page...

On the other hand, every serious webpage is using encryption today - so I don't think that would be a problem for such a small forums...

Vote: Yes.

Regards.
Odi profanum vulgus
tomazzi
 
Posts: 730
Joined: 2013-08-02 21:33

Re: SSL in Debian Forums

Postby GarryRicketson » 2016-03-25 20:47

Well I am glad it is not SSL, Just now experiementing with a freshly installed NETBSD system, and it said I don't have the ssl certificates setup, or configured, if it was "https" I would not be able to connect.
Making it https could make it difficult for some people to connect, expecially for those with problems in a newly installed system and they might not have some of those things configured yet.
I can see where https is needed on some sites, especially like banking sites, or sites where the information being exchanged must be kept confidentual , but I don't think it is needed here and it could very well be a hinderance.
"What we expect you have already Done"

Before doing anything, read the Debian documentation:
Debian Documentation
How to ask the smart way
Debian Foro Español
======================
For the Birds
User avatar
GarryRicketson
 
Posts: 4218
Joined: 2015-01-20 22:16
Location: Durango, Mexico

Re: SSL in Debian Forums

Postby kedaha » 2016-03-26 10:20

levlaz wrote:Once this is live we should just use it. It costs nothing and works in any browser.

https://letsencrypt.org/

I've just obtained a free certificate for one of my domains for a raspberry pi server running raspbian-jessie based on Debian Jessie, using letsencrypt and it was a breeze & works just fine.
Mate DE & OSSv4.
LaMp, WordPress; ispmail
Debian Stable & Software

Words, as is well known, are the great foes of reality. Joseph Conrad.
User avatar
kedaha
 
Posts: 2789
Joined: 2008-05-24 12:26

Re: SSL in Debian Forums

Postby squeeze » 2016-04-08 14:46

wizard10000 wrote:forums.debian.net isn't an official Debian resource.


Whois says otherwise:
Registrant Organization: Software in the Public Interest, Inc. - Debian Project
“Have you tried turning it off and on again?”
User avatar
squeeze
 
Posts: 299
Joined: 2010-06-14 23:16
Location: thimbleweedpark

Re: SSL in Debian Forums

Postby 4D696B65 » 2016-04-08 17:29

The only reason I see in support of SSL on this forum is protection of passwords.
I as a forum admin have no power or tools to implement SSL.
If you feel strongly about this, you should pm the server admins, Mez and Ganneff.
User avatar
4D696B65
 
Posts: 1993
Joined: 2009-06-28 06:09

Re: SSL in Debian Forums

Postby squeeze » 2016-04-08 17:33

4D696B65 wrote:If you feel strongly about this, you should pm the server admins, Mez and Ganneff.


Thanks for the reply. I pm'd the admins.
“Have you tried turning it off and on again?”
User avatar
squeeze
 
Posts: 299
Joined: 2010-06-14 23:16
Location: thimbleweedpark

Re: SSL in Debian Forums

Postby alderaan » 2016-04-09 18:50

squeeze wrote:
wizard10000 wrote:forums.debian.net isn't an official Debian resource.


Whois says otherwise:
Registrant Organization: Software in the Public Interest, Inc. - Debian Project


I can't find an official statement for this but debian.net is for projects that are not official (such as this site). When a project becomes official it is moved to debian.org.
alderaan
 
Posts: 90
Joined: 2013-07-25 20:20

Re: SSL in Debian Forums

Postby GarryRicketson » 2016-04-10 00:07

I don't know what it matters if it is "official" or not, it exists for users to get help and support,and functions, and so it is real.
Debian.org lists the forum as source for support.
https://www.debian.org/support#web
Web sites
Forums

debianHELP and Debian User Forums are web portals on which you can discuss Debian-related topics, submit questions about Debian, and have them answered by other users.
"What we expect you have already Done"

Before doing anything, read the Debian documentation:
Debian Documentation
How to ask the smart way
Debian Foro Español
======================
For the Birds
User avatar
GarryRicketson
 
Posts: 4218
Joined: 2015-01-20 22:16
Location: Durango, Mexico

PreviousNext

Return to Forum stuff & feedback

Who is online

Users browsing this forum: No registered users and 1 guest

fashionable