https isn't working.

[planetjay]

Just sayin...

[Rataplan626]

2022 and still no https... In these days it's really not done to pass your login credentials over a http link, for everyone to read along with you. Why isn't something trivial as LetsEncrypt not implemented? Free to use yet secure connections.

[lilshawn]

you know how much of a pain in the ass https implementation is especially when you dont want to pay for a cert and you do it through lets encrypt and it expires and your website goes down cause certbot doesn't verbose worth a damn if it has an issue and it takes you a year to iron out the script to auto renew cause you can only activate a recert every 90 days even though they say you can do it every 60 but you can't cause it says its not close enough to expiry date to renew so it takes 3 months to find out if it works and then you discover it doesn't so you change your script and wait another 3 months to see if your website displays or not?

i hope my works server never goes down cause if it does, i'm screwed.

[Rataplan727]

Well... 'the world' uses Let's Encrypt, so I guess some parts of it work quite well Personally I've never ever had any issue with renewing Let's Encrypt certificates on either Linux or Windows. For Linux (Ununtu LTS) we use a simple cron job, which has been running for about 6 years now without issues, even after server OS upgrades. It would certainly improve site security.

Same for mail. I am currently locked out of my main account here, as I changed that to a hotmail address, which seems to block mail from AradeControl at a rather low level. Looking into it, there is a practically useless SPF record, no DKIM, no DMARC and TLS1.0 and 1.1 being configured. Being an owner of an IT company, and having had to help several customers out of issues with mailflow not working correctly, I can't blame Microsoft for blocking those mails. In fact, if everyone blocked unsecure (email) connections, the internet would be a much safer place.

It doesn't take a lot of effort to take things up to a better level of security. If you need any help or suggestions, just ask!

[pbj]

Go away, noob.

[Rataplan727]

Who do you think you are to offend me like that? Tells people more about you than about me.

[lilshawn]

Well... 'the world' uses Let's Encrypt, so I guess some parts of it work quite well Personally I've never ever had any issue with renewing Let's Encrypt certificates on either Linux or Windows. For Linux (Ununtu LTS) we use a simple cron job, which has been running for about 6 years now without issues, even after server OS upgrades. It would certainly improve site security.

Same for mail. I am currently locked out of my main account here, as I changed that to a hotmail address, which seems to block mail from AradeControl at a rather low level. Looking into it, there is a practically useless SPF record, no DKIM, no DMARC and TLS1.0 and 1.1 being configured. Being an owner of an IT company, and having had to help several customers out of issues with mailflow not working correctly, I can't blame Microsoft for blocking those mails. In fact, if everyone blocked unsecure (email) connections, the internet would be a much safer place.

It doesn't take a lot of effort to take things up to a better level of security. If you need any help or suggestions, just ask!

-I- use letsencrypt and it took several renewal cycles worth of testing to ensure the damn thing would renew right. that's just me i guess.

but, for reals... let's put this into another perspective...

if absolutely NOTHING changed other than going from HTTP to HTTPS.... what would change? how would the security here be improved? it would not.

all HTTPS does is secure an encrypted connection from the arcadecontrols server... to you.

now, if you were transferring bank data, creditcards, or confidential weapons schematics... sure... but FFS, we are talking PUBLICLY about literal crap here most days. if ruskies want to see what data i'm sending... all they would have to do is wait till i submitted the post and READ IT. it's literal public info. and if i'm sending something by PM that requires any sort of security, i'd be doing it some other way, cause PM's are NOT for that kind of stuff anyway.

If chinashills want to edit my post on the way through to edit out "1989 Tiananmen square" to say "1989 nice day nothing happened" then by all means give'er bullets.

honestly, dismiss the HTTPS error message and you'll never see it again.

[pbj]

Well, that all being said, Apple swears my password here has been compromised about three times in the last three months.  I just keep changing it to something dumber.

 

[Rataplan727]

-I- use letsencrypt and it took several renewal cycles worth of testing to ensure the damn thing would renew right. that's just me i guess.

but, for reals... let's put this into another perspective...

if absolutely NOTHING changed other than going from HTTP to HTTPS.... what would change? how would the security here be improved? it would not.

all HTTPS does is secure an encrypted connection from the arcadecontrols server... to you.

now, if you were transferring bank data, creditcards, or confidential weapons schematics... sure... but FFS, we are talking PUBLICLY about literal crap here most days. if ruskies want to see what data i'm sending... all they would have to do is wait till i submitted the post and READ IT. it's literal public info. and if i'm sending something by PM that requires any sort of security, i'd be doing it some other way, cause PM's are NOT for that kind of stuff anyway.

If chinashills want to edit my post on the way through to edit out "1989 Tiananmen square" to say "1989 nice day nothing happened" then by all means give'er bullets.

honestly, dismiss the HTTPS error message and you'll never see it again.

sure, and I can agree with some of it. But still, being an IT guy, my response it, would you keep your house unlocked even if you took your valuables out? The fact that there's no real private information here, doesn't mean we couldn't make things more secure in my book. But this is going nowhere, so never mind.

[pbj]

Regularly for the last 20 years, countless 'network engineers' and their ilk have offered to fix BYOAC.  Thus far their pleas to drag us into at least the 2002-2003 era have fallen on deaf ears.  This place is one hack away from being shut down permanently and apparently.... we like it that way?

[Rataplan727]

Whatever. I am judged here and put aside as 'another network engineer' without any context of what I actually can do, am willing to do or where my skills are at. With that attitude I can imagine things will indeed some day be over. I thought in a community people help each other to reach a certain goal. Well, alas. At least I tried.

[pbj]

Whatever. I am judged here and put aside as 'another network engineer' without any context of what I actually can do, am willing to do or where my skills are at. With that attitude I can imagine things will indeed some day be over. I thought in a community people help each other to reach a certain goal. Well, alas. At least I tried.

 

[lilshawn]

This place is one hack away from being shut down permanently and apparently.... we like it that way?

i think since the big server migration fiasco... there hasn't been much by way of keeping things moving. seems the idea now is for something catastrophic to happen and then we can toss the whole thing out and everyone goes their separate ways. the info here will be lost forever. 

[Malenko]

Whatever. I am judged here and put aside as 'another network engineer' without any context of what I actually can do, am willing to do or where my skills are at. With that attitude I can imagine things will indeed some day be over. I thought in a community people help each other to reach a certain goal. Well, alas. At least I tried.

He was actually talking about me (and others?). I am a solutions engineer / infrastructure architect /many other titles in my nearly 30 year career.  I have offered to fix issues on the site for more almost 2 decades. I actually did fix search; you're welcome.

Saint is the head-honcho and if he doesn't want to fix it, it wont get fixed. The only downfalls of not using HTTPS (for this site) is the password being sent in clear text and the "not secure" warnings.  This place has other more pressing issues to resolve, like having an arcade1up section and people googling for other people.  The back end part of the server is secure enough, I have grey hat knowledge of it so I could get in and wreck shop if I wanted.