[Lumiera] Server HTTPS

Christian Thaeter ct at pipapo.org
Thu Oct 25 22:37:24 CEST 2018


Transition mostly done/in progress. BUT:

We have a lot links using http: to https: (Firefox otherwise warns that
the site is not secure).

Rather than rewrite them automatically (which needs some distinction if
they are internal or external) I rather fix them in the website source,
starting with the staging repository now.

Question: is there a deeper meaning that we use a redundant link:.. in
links like:

  link:http://issues.lumiera.org/report/15[...]

I'll now convert those to:
  
  https://issues.lumiera.org/report/15[...]



note2: gitweb is dead, long live gitweb

 https://www.lumiera.org/gitweb/

still works, but consider it obsolete, gitweb is now available under:

 https://git.lumiera.org/

(and https://git.lumiera.org/gitweb for completeness)


Todo for ichthyo:

Trac is on https too now, works fine but firefox complains, I think its
only the Logo on the top linking back to http: can you check and fix
this please, I dont know much about Trac.



BIG disclaimer:

I am noob when it goes into webserver/apache configuration. If anyone
spots some errors, broken links etc, please notify me.


	Christian




On 2018-10-24 03:56, Ichthyostega wrote:

> On 10/23/18 10:52 PM, Christian Thaeter wrote:
> > The Webserver for the Mailinglists is now https only (with http
> > redirecting). This adds some security since user and config actions
> > go though this interface.  
> 
> Hi Christian,
> 
> thanks for pushing that one ahead....
> 
> > Another question is if we want to make the normal webserver/webpage
> > https. I guess the answer is 'yes' because http is a dying breed.
> > Google Chrome will phase it out eventually, Sites which don't
> > deliver content via https get downranked. I personally don't see
> > much advantages there, but I know the drill and will deploy that
> > later on. Actually plain HTTP has more advantages since it doesnt
> > force users to accept cooperate MitM attacks and webcaches can
> > cache pages universally.  
> 
> Fully agreed. <rant> And we should add, that plain vanilla static
> webpages also seem to become rare exotic animals. Anyone is just
> dying to run a bloated WordPress or similar kind of CMS, which allows
> to add content and new features through plug-ins, without requiring
> in-depth technical knowledge. Not to mention all those personalised
> advertisements, rendering "personal data" which totally needs to be
> protected cryptographically</rant>
> 
> Anyway, we don't have much choice here, other than following the
> mainstream and offer the website via HTTPS.
> 
> Cheers,
> Hermann
> 
> 
> 
> _______________________________________________
> Lumiera mailing list
> Lumiera at lists.lumiera.org
> http://lists.lumiera.org/cgi-bin/mailman/listinfo/lumiera
> http://lumiera.org/donations.html


More information about the Lumiera mailing list