HTTPS now available on L19!

apetresc · #1

Hey everyone! As has been requested a few times now, lifein19x19.com now supports HTTPS: https://lifein19x19.com.

What This Means
For the non-technically-inclined among us, this basically means that L19 is a little bit safer today than it was yesterday. HTTPS protects against a certain class of attacks that would theoretically allow a malicious network to intercept your L19 traffic (most importantly, your password). There's absolutely no reason to believe this kind of attack was ever used - it's just a best practice to avoid it.

How To use It
All you have to do to take advantage of this is to use https:// instead of http:// when you visit lifein19x19.com from now on, so please update your bookmarks

Once you do, you should see that comforting green lock:

In order to make 100% sure that everything is working cleanly with HTTPS, I'm going to leave the site with HTTP still enabled for the next 7 days, during which time HTTPS is optional but I highly encourage everyone to try it out and test it. After the 7 days are up, assuming no unfixed issues arise, I'm going to make HTTPS the default and all the old http:// links will simply redirect to https://. This shouldn't require any change whatsoever to your browsing patterns, just carry on as you were before!

Known Issues

During the beta, it will still be possible for someone on HTTP to upload an attachment to a post and embed it (through, say, [sgf] tags) using the http:// link they get by right-clicking on the attachment URL. If they do this, the embed will fail for HTTPS viewers, since the browser will see insecure content from the same domain as an HTTPS page, which is a no-no. Once the beta ends and everyone is on HTTPS this won't be possible anymore, but for the time being, if you're using HTTP, please make sure any embeds on the lifein19x19.com domain use HTTPS, even if you're not! (Note, this does not apply to embeds from other domains. Those will still work).
On some pages, instead of the green lock, you may see a non-secure "information" bubble, which when clicked on shows something like this:

What this means is that someone in the thread has put in an image (using [img] tags) from another domain (not L19) with an http:// protocol. Theoretically this means that the hypothetical attacker might discover (and/or manipulate) that particular picture, but that's not a very realistic concern. All the rest of your traffic - including your passwords - are still being protected, and only the page with that image should have this issue. To mitigate this, please use https:// when linking to things outside of L19 whenever possible, unless the site you're linking to doesn't support HTTPS for some reason.

Other than that, everything should work exactly as well as it has before

In particular, I've gone over all old [sgf] embeds and ensured they are ported over to HTTPS so they should continue working. Please reply to this thread if you notice any issues!

Cheers!
- The L19 Admin Team :salute:

apetresc · #2

Since there didn't seem to be any problems reported for HTTPS, it is now the default - any requests to http://lifein19x19.com will be automatically redirected to https://lifein19x19.com!

Bill Spight · #3

I am seeing many game records in old posts that do not display. Rather annoying.

apetresc · #4

Bill Spight wrote:

I am seeing many game records in old posts that do not display. Rather annoying.

Oh! Can you link me an example or two? I thought I had fixed all of those instances, but I might have missed some.

Uberdude · #5

Perhaps the problem with embedded game records is because the download link in the sgf tag is plain http? I just made a post in which I uploaded an sgf, previewed to get the download url and then copy-pasted that into sgf tags. It was http and the game didn't load. I've just edited it to be https and it now works.

apetresc · #6

Uberdude wrote:

Perhaps the problem with embedded game records is because the download link in the sgf tag is plain http? I just made a post in which I uploaded an sgf, previewed to get the download url and then copy-pasted that into sgf tags. It was http and the game didn't load. I've just edited it to be https and it now works.

Yup, that's the issue I called out in the original post - and it shouldn't happen for any new posts now that it's HTTPS by default, since any links you right-click-copy should also be HTTPS. I had also fixed it for any posts made prior to last week. Have any slipped through the cracks?

Bill Spight · #7

apetresc wrote:

Bill Spight wrote:

I am seeing many game records in old posts that do not display. Rather annoying.

Oh! Can you link me an example or two? I thought I had fixed all of those instances, but I might have missed some.

OK.

https://lifein19x19.com/forum/viewtopic ... 83#p127483

https://lifein19x19.com/forum/viewtopic ... 98#p208998

https://lifein19x19.com/forum/viewtopic ... 92#p219192

https://lifein19x19.com/forum/viewtopic ... 78#p215478

https://lifein19x19.com/forum/viewtopic ... 32#p207232

Surely there are more.

apetresc · #8

Bill Spight wrote:

apetresc wrote:

Bill Spight wrote:

I am seeing many game records in old posts that do not display. Rather annoying.

Oh! Can you link me an example or two? I thought I had fixed all of those instances, but I might have missed some.

OK.

forum/viewtopic.php?p=127483#p127483

forum/viewtopic.php?p=208998#p208998

forum/viewtopic.php?p=219192#p219192

forum/viewtopic.php?p=215478#p215478

forum/viewtopic.php?p=207232#p207232

Surely there are more.

Woah! Not sure why my regex missed them the first time :oops:

... either way, they're fixed now! Thanks for the catches

Like I said, these kinds of errors won't happen anymore now that HTTPS is forced (unless someone were to go out of their way to remove the 's' from the link they copied), but I guess some old ones slipped through the cracks.

apetresc · #9

(Actually, one thing I forgot to mention - the first link you posted was actually not caused by the HTTPS bug at all. It's just a bad link to OGS, not L19. The link itself is dead on OGS' site, so there's not much I can do about that...)

Bill Spight · **#10**

Here's another.

forum/viewtopic.php?p=211101#p211101

Kirby · **#11**

Bill Spight wrote:

Here's another.

forum/viewtopic.php?p=211101#p211101

I fixed/updated that one.

Kirby · **#12**

apetresc · **#13**

Kirby wrote:

I started updating a bunch of these manually, but then realized that I could modify the bb-code definition for sgf tags. I did this for now, so even when the post includes an L19 http URL, the string is substituted.

Hopefully this addresses at least the situation with sgf tags. Let me know if you find any problems with this.

That's... an infinitely better solution than fixing it in the database

Great catch, Kirby! I think I hadn't consciously realized that BBCode is re-rendered every time a post is viewed, not just at posting time.

HTTPS now available on L19!

Who is online