The wiki should support HTTPS

[alexvong243f]

Hi,

The description of the project writes Agda is a dependently typed programming language / interactive theorem prover. https://wiki.portal.chalmers.se/agda/pmwiki.php. However, when I visit https://wiki.portal.chalmers.se/agda/pmwiki.php, I get the following error:

The requested URL was not found on this server. The link on the ">referring page seems to be wrong or outdated. Please inform the author of ">that page about the error. If you entered the URL manually please check your spelling and try again. 

Is it because the home page of agda has been moved to somewhere else? If so, what is the new official home page?

[UlfNorell]

The wiki doesn't do https. As far as I can see we don't have any https links though.

[alexvong243f]

Ulf Norell <notifications@github.com> writes:

The wiki doesn't do https. As far as I can see we don't have any https links though.

Thanks for the quick reply! So the underlying reason must be the fact that I've enable the option to block all unencrypted requests... Btw, I really hope the site would switch to use HTTPS as HTTP is not secure (it's vulnerable to MITM attacks). For examples, by using Let's Encrypt[0]. Also, both mozilla[1] and google[2] have plans to deprecate HTTP eventually. [0]: https://letsencrypt.org/ [1]: https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/ [2]: https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure

…

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[jespercockx]

Wait, why don't we serve the wiki over https??! I know it is old-school, but that is really something we should fix. If it's too hard with the current hosting, then I see that as (another) good reason to move it somewhere else.

[ice1000]

BTW there're a lot of outdated materials on Agda wiki. Like, the instance argument parts say Agda will search for type constructors, but

open import Agda.Builtin.Nat
postulate f : {{ Nat }} -> Nat
_ : Nat
_ = f

doesn't work.

[jespercockx]

It seems counterproductive to keep both the wiki and the official documentation on readthedocs up-to-date. I think it would be better to go over all the old wiki pages with documentation, move everything that's still relevant to the docs, and then remove them.

[nad]

You're discussing several distinct issues above:

• Enable HTTPS.
• Move the wiki to some other host. (And switch to different wiki software?)
• Merge relevant wiki material into the user manual, and remove outdated material.

I'd like to add that, if we move to some other host, then I'd like to see the wiki history preserved in some way. I wouldn't want to lose, say, the documentation of all the old Agda meetings.

[ice1000]

I wonder if the domain name www.agda-lang.org is owned by someone in the team?

[UlfNorell]

Yes, me.

[ice1000]

@UlfNorell Any plan to create a website with the domain name? We can make use of GitHub Page's custom domain name functionality.

[UlfNorell]

No immediate plans, but some vague long-term ambitions. I'm a bit daunted by the prospect of migrating the wiki though...

[alexvong243f]

Ulf Norell <notifications@github.com> writes:

No immediate plans, but some vague long-term ambitions. I'm a bit daunted by the prospect of migrating the wiki though...

Long-term ambitions are of course great in the long run, but is it possible to apply a quick / temporary fix like using Let's Encrypt for the current wiki?

…

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[nad]

@UlfNorell, have you asked the Chalmers support team whether they are willing to enable HTTPS?

[nad]

Btw, I really hope the site would switch to use HTTPS as HTTP is not secure (it's vulnerable to MITM attacks).

Given that anyone can update the wiki I think there are other attack vectors.

[UlfNorell]

have you asked the Chalmers support team whether they are willing to enable HTTPS?

I have not.

[alexvong243f]

Nils Anders Danielsson <notifications@github.com> writes:

Btw, I really hope the site would switch to use HTTPS as HTTP is not secure (it's vulnerable to MITM attacks). Given that anyone can update the wiki I think there are other attack vectors.

Yeah, you are right that there are certainly other attack vectors. But I think MITM are more "stealthy" (editing the wiki would leave traces visible to everyone, while MITM would only leave traces to those being targeted). I could be overlooking other factors though ...

…

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[ice1000]

So come on, let's build a github.io website and use CNAME to map our custom domain to it!

When I see my friends (I'm an undergrats freshman) see www.idris-lang.org or www.fstar-lang.org and go to learn those languages I feel really jealous!

[ice1000]

So come on, let's build a github.io website and use CNAME to map our custom domain to it!

I mean I just want to see a website, which is in any sense better than simply a wiki.
We can by the way have https then.

[jespercockx]

I have sent a mail to Chalmers support to ask if they can enable https for the current wiki.

[jespercockx]

I got an email back from the support:

Hi Jesper

This is in my incredibly long queue of upgrades and updates I need to make.

Can you send me the source(s) of your information so I can read the article(s) myself to determine the exact course of events that will happen and when.

I sent them the two links that @alexvong1995 posted here. However, I do not have great confidence that anything will happen anytime soon, so if we are serious about https we should look into other solutions.

[jespercockx]

Good news: I just got an email back from support saying that they have enabled https on the wiki, and any http requests should now be redirected to https automatically. I still think it's a good idea to have a nice front page for Agda which is not a wiki, but at least this issue can be closed now.

[ice1000]

Please update the link here

[ice1000]

And here

[jespercockx]

It seems I don't have the permission to change these links. @UlfNorell can you do it?

[UlfNorell]

Done.