DaemonForums and https?

[hitest]

I would like to start this post out by stating that I am a long time, happy member of DaemonForums. This website has helped me many times with valuable information and very knowledgeable members. This website is my go to place if I am stuck with a BSD issue.
I have a question. When I log-in here I get warnings about insecure log-ins. Is there a possibility of our forum moving to https? If not, is this a costly move?
Thanks for any and all replies.

[PapaParrot]

Actually, the certificates to make it "https" are available for free, no cost.
However I have mixed feelings, about "https", and just because it
say"https", and has the little green thing saying it is secure does not mean
it really is secure at all, so in my opinion it is pointless.
https://perezbox.com/2015/07/https-d...-your-website/
Another:
https://www.sott.net/article/275524-...e-as-you-think
and
https://www.wordfence.com/blog/2017/...code-phishing/

All though the certificates can be gotten for free, actually installing them and
getting the site to work after words is not so easy or simple, at least to me.
I don't know how the admins of this site feel about it, or what reasons they
have for not using it. I don't mind, in fact I prefer just http, for this type of site.
I have seen this topic / discussion pop up on some other forums
that don't use https, ....

[ibara]

I think it's a good idea to move to https.
Less about the password thing (tbh, I'd be much more worried about security flaws in vBulletin being exploited), and more about the fact that Google's algorithm is going to (if it hasn't already) punish non-https sites by demoting them in the rankings. I'd prefer this site not get punished.

[PapaParrot]

Google's algorithm is going to (if it hasn't already) punish non-https sites by demoting them in the rankings. I'd prefer this site not get punished.

That by it's self is a good reason to use https, and it does appear the "algorithm" has started/is doing that.
I have noticed a change, when I search, (usually I use "startpage"), any way when I
search, IE: How to do " this or that " on OpenBsd (or other OS) " The results used to
point to either this forum, for OpenBsd, or the same , a forum for the "OtherOS',...
Lately most of the results, if not all point toward other sites, all of which are "https".
and the "http" sites do not show, or are at the bottom,..
The only time the http sites show is when there is nothing on "other https" sites.
A little over a year ago, this was not the case.
So any way, I do think it would be a good thing for this site to use https, and it would be a help to any one just starting to use a BSD. That is to say , when I first started with Open Bsd, and also was looking at the others,NetBsd,FreeBsd, etc,...this site was right there at the top of the results, so it was easy for me to find. Now that I know about it, no big deal, but some one "new" recent, will not see this site when the do a search, ...

[hitest]

Originally Posted by ibara

I think it's a good idea to move to https.
Less about the password thing (tbh, I'd be much more worried about security flaws in vBulletin being exploited), and more about the fact that Google's algorithm is going to (if it hasn't already) punish non-https sites by demoting them in the rankings. I'd prefer this site not get punished.

Thanks for the heads-up about Google punishing non-https sites like ours. Is there a possibility that we will be moving to https?

[ibara]

The only ones who can decide that is the moderating team. And I respect their time and efforts to not pester them. If and when they want to do it, they'll do it.

[hitest]

Originally Posted by ibara

The only ones who can decide that is the moderating team. And I respect their time and efforts to not pester them. If and when they want to do it, they'll do it.

Agreed. That is why I phrased my initial post in a respectful manner. I also respect their time and efforts. My intention was not to pester or annoy them. This site is my primary BSD resource.
I'll leave this alone now. I'm very happy to be a member here.

[Beastie]

Well, the very first result I get when searching for "openbsd forums" is "http://daemonforums.org/".

"netbsd forums"? I get "https://www.netbsd.org/community/" as a first result, with its description below including "... Daemon Forums". The second result is "http://daemonforums.org/forumdisplay.php?f=16" and the third is "http://daemonforums.org/".

I think we'll be alright.

[drhowarddrfine]

Originally Posted by ibara

I think it's a good idea to move to https.
Less about the password thing (tbh, I'd be much more worried about security flaws in vBulletin being exploited), and more about the fact that Google's algorithm is going to (if it hasn't already) punish non-https sites by demoting them in the rankings. I'd prefer this site not get punished.

Not quite correct. Google will demote a site that handles passwords, credit cards and other security related items that do not use encryption. Sites that do not need such things are not demoted.

Getting TLS up and running on a FreeBSD site running nginx is a piece of cake with the basic settings and using security/certbot and only takes a minute.

[ibara]

Originally Posted by drhowarddrfine

Google will demote a site that handles passwords

.

[drhowarddrfine]

@ibara Yes, that's correct, but he implied any site of any type will be demoted.

[Carpetsmoker]

Originally Posted by drhowarddrfine

Not quite correct. Google will demote a site that handles passwords, credit cards and other security related items that do not use encryption. Sites that do not need such things are not demoted.

Getting TLS up and running on a FreeBSD site running nginx is a piece of cake with the basic settings and using security/certbot and only takes a minute.

Setting the correct date is even easier, and that hasn't been done yet either ;-)

I'm not 100% sure who is responsible for the technical maintenance of the forums these days. I transferred stuff over to j65nko in 2014, but I vaguely remember hearing that ocicat is also involved in the management.

If you have some spare time, then maybe you can try sending a PM to both to offer your services?