Bitcoin Forum

<eom>

+1

+1

I don't really understand why it still supports plaintext http at all. The only use for http servers is to redirect to https :)

The reason for this used to be because the forum used a self-signed certificate that produced scary warnings in some browsers. This was solved a while ago, though, and we could easily go full https.

With all the shenanigans with exchanges and DDOS against pools, it's only a matter of time till the forums fall victim to something...
Would SSL by default help avoid "some" problems?  Probably.

A cert is very inexpensive nowdays. I'm sure ppl would chip in for this purpose if we were asked to do so.

It keeps your credentials encrypted at least which makes man in the middle attacks essentially not possible [I suppose if they have the certificate and somehow change DNS records ...].

Chip in? You realize the people who started BTC have 100,000s of BTC right? Wildcard cert is like $200.

So what?  If the call came, ppl would chip in.  Or you can lobby these people you are talking about to pay for it.  Go for it!

HTTPS might increase load too much for the server to handle.

The cookies also need to be made secure. Right now you'll send them over an insecure connection if you ever visit any HTTP page even if you use HTTPS normally.

Properly configured servers won't have any issues with SSL. Poor excuse.

You could try it out, though. I don't think the difference will be significant. Most of the work a forum server does is not related to the network but to database I/O, and secondly PHP logic generating the pages.

Others, about the certificate: you don't need to "chip in" as there is already a proper certificate now. It was a problem of the past.

It does support running the forum on https, or will the login explicitly go to the http page first?

SSL does actually cause extra server load, even if it's just a little. For something that is under DDoS rather often (like these forums) that may be a dealbreaker.

I'm just shaking my head in dismay at you all who are coming up with excuses not to have SSL.

I don't think people are specifically arguing against SSL, but rather arguing against making it the default.

Whatever... Just make it happen please.  Let us know how we can help. Thanks.

Just to be clear to everyone reading this thread, you can already browse the forums with SSL. In the URL bar, simply add an s on the end of http, and you'll be good (Yes, they already have a cert).

The OP is about making this the default, not about adding SSL support.

+1
no excuses, this is a cryptocurrency forum for fuck's sake, we need security by default, not after someone has exploited it already

/aol on

Me too!

/aol off

Best one line post since the forum's inception. And true.

Why does everything need to be utterly broken before it's fixed and someone admits 'more could've been done' after the fact?

The worst should be assumed always, 24/7.
That's not pessimism, that's realism and that's how the world works. Weakness will be always exploited.