SSL in Debian Forums

[jesus92gz]

Hello.

Website: forum
Severity: wishlist

I have noticed that while other websites in Debian are SSL secured, the forum is not.

Is there any possibility to secure the forum with SSL?

[levlaz]

I didn't even realize that this was the case.

+1 for SSL

[Sarge-in-charge]

Is there any possibility to secure the forum with SSL?

I vote NO if it's going to be with a self-signed certificate or with a certificate chained up to a CA not by default in Firefox.

Otherwise, I vote YES.

[Head_on_a_Stick]

Why does this matter?

[Head_on_a_Stick]

Sorry, I meant: why does it matter if the forums use SSL?

[roseway]

Anyone who uses the same password on a public forum as they use for something confidential is asking for trouble anyway. SSL is pointless on a forum like this.

[Sarge-in-charge]

SSL is pointless on a forum like this.

This is so wrong on many levels.

No HTTP traffic should be sent on the clear. Period. That's just the way it is in the post-Snowden era.

[levlaz]

Once this is live we should just use it. It costs nothing and works in any browser.

https://letsencrypt.org/

[levlaz]

Honestly after thinking about this some more I think there is no excuse to not have a valid SSL certificate. I will buy (and if needed configure) the SSL cert for this site, does anyone know who we need to talk to in order to make this happen?

[jesus92gz]

Why does this matter?

Apart from the previous users' replies, I can see the Debian site is using SSL everywhere.
For example:
Official Site: https://debian.org/
Wiki: https://wiki.debian.org/
...

Why should the forum not use SSL as well?

[jesus92gz]

forums.debian.net isn't an official Debian resource.

Really? I thought it was.
Anyways, I think supporting SSL could improve the security of the forums to the end users. Just in case.

[kolker]

it not a end of the world thing but imo it should be a default on all sites. this is not because some thing sensative is happening per se or anything its just a good policy for all comunications.

[dotlj]

https://www.eff.org/https-everywhere

[millpond]

Personally, I would love to have the NSA listen to what I have to say about systemd.

[Chiefahol]

+1

You know mint just got their website completely owned.

It's probably time to use HTTPS on the main website and forums.

What's the delay about?