Topic: neo-source forum news thread!

[dink]

Dear friends and fans of FBAlpha,
Our forum address has changed to http://neo-source.com, please update your bookmarks!

best regards,
- dink & pals

[Gab75]

Bookmark updated! Very good news, finally a more stable server for the forum!

[jan_klaassen]

FYI, Firefox says:

An error occurred during a connection to neo-source.com. SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG

[dink]

use http://

[jan_klaassen]

I did, that's how I was able to post this. Just saying that SSL seems to be mis-configured -- Edge says so too. With SSL being the default these days you might want to fix that...

[Barry Harris]

SSL isn't configured - there is no certificate. Edge/Firefox/Chrome all default to http:// when not specified.

SSL is enabled in Apache due to being supported and being the only available option for fbalpha.com.

Two options to stop SSL errors for users forcing browsing to https;

1. Buy and continue to pay annually for an SSL certificate.
2. Use .htaccess to 301 Redirect https to http

A 301 should also be put in place on the old URL to inform Google and other bots that the site has moved. This will also make the process transparent for the user too,

[Barry Harris]

Actually .htaccess may not be an option due to the server/browser attempting to secure the connection prior to any redirects, etc. happening.

There isn't an issue though, unless the user attempts to access https themselves....

[jan_klaassen]

Ah, yeah. I understand the problem.  Easy solution though, particularly if you already have SSL for another domain so you know what hoops to jump through: use a free certificate.

See https://letsencrypt.org/ for more (haven't tried yet, I used the free SSL from startcom before, but that's gone now).

Again, I brought up because https is the default in most browsers, and they don't give you the option to ignore the error or try an insecure connection anymore (you have to type http:// in the url bar).

[Barry Harris]

Typing neo-source.com in  any browser takes you to http. I literally just did it on a machine I rarely use  (ie, never visited the donain before on) with latest edge, firefox and chrome. All go to http. The only way to they try https is if the user specifically types it.

[jan_klaassen]

Interesting, since I had the opposite experience with firefox and edge. I checked edge again, and that doesn't delete history until you close it, so that's probably it. I dunno about firefox -- I definitely didn't ask for a secure connection, and I don't have an add-on that forces them (because way too many websites are still set up badly).

[Barry Harris]

Even Google is only just starting to give any priority to https in search rankings. It will be years before browsers start forcing it.

Heck, browsers are only just starting to take the whole startssl mess seriously and start to not trust those certificates.

[hursit]

it has been updated
thanks....

[jan_klaassen]

My impression has been that they'd like to switch to secure connections, but the staggering number of badly configured servers won't let them -- you can't silently fail in this case (duh). The other problem has been (a lack of) trustworthy free certificates, but letsencrypt.com should help there (before both of the the startssl debacles there was the cacert debacle, etc).

I've mostly dealt with dedicated servers, so I'm not much help with vhost type setups (except to point out they don't work of course).

[Barry Harris]

My impression has been that they'd like to switch to secure connections, but the staggering number of badly configured servers won't let them -- you can't silently fail in this case (duh). The other problem has been (a lack of) trustworthy free certificates, but letsencrypt.com should help there (before both of the the startssl debacles there was the cacert debacle, etc).

I've mostly dealt with dedicated servers, so I'm not much help with vhost type setups (except to point out they don't work of course).

It's an issue with vhosting, which is obviously very prevalent. Hence why google are moving very slowly and browers even slower.

Letsencypt might help. But most people avoid it due to the constant renewal process and the need to run their middleware on the server.

[jan_klaassen]

I could type lots about the Bad Things that happen when an idiot rents a server with Plesk on it. But I won't and you've probably seen your share of it anyway. I will say that if letsencrypt works, then shut up and install the %$%^ middleware already. Puppies and unicorns will ensue. Or at least a more secure internet.