Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use TLS / HSTS for the site, discourse, etc. #17914

Closed
annevk opened this issue Oct 10, 2014 · 8 comments
Closed

Use TLS / HSTS for the site, discourse, etc. #17914

annevk opened this issue Oct 10, 2014 · 8 comments

Comments

@annevk
Copy link

annevk commented Oct 10, 2014

That way active attackers cannot spoof download links for software from insecure pages and credentials cannot be leaked passively from the forums.

https://wiki.whatwg.org/wiki/TLS has more reasons if those are not sufficient.

Endgame: http://hstspreload.appspot.com/

@frewsxcv
Copy link
Member

Related issue: #13180

@steveklabnik
Copy link
Member

Discourse is now on https, and the earlier issue covers the site, so I'm giving this a close.

@annevk
Copy link
Author

annevk commented May 7, 2015

http://users.rust-lang.org/ does not use HSTS for me (or even redirects to HTTPS).

@annevk
Copy link
Author

annevk commented May 7, 2015

Does site include the blog and the docs?

@steveklabnik
Copy link
Member

@annevk it does for me...

And yes, the site does include the blog and docs. The docs have HTTPs access, and the site and blog have the same root cause: github pages hosting.

@annevk
Copy link
Author

annevk commented May 7, 2015

I think it does not do a 301 or some such. When I open a fresh browser the initial load does not redirect to HTTPS.

@steveklabnik
Copy link
Member

Which browser are you using? I'm on Firefox on linux. It still redirects for me.

(and really, this would be an upstream issue, as this change was made by requesting it from discourse /cc @brson @coding-horror)

@annevk
Copy link
Author

annevk commented May 7, 2015

Nightly on OS X. Then Safari (stable) on OS X. Now Chrome dev on OS X.

"Still redirects" is not the problem by the way, that bit works (and it's not a redirect, but a browser rewrite), it's the initial connection which you can only get if you clear your HSTS cache or use a different browser.

lnicola pushed a commit to lnicola/rust that referenced this issue Aug 29, 2024
Pin `rowan` to `0.15.15`

To prevent rust-lang#17914, I think that it would be safer pinning this before we fix it correctly
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants