Enable HTTPS for blogs.perl.org

[briandfoy]

I'd like to use HTTPS everywhere so man in the middle problems like http://blogs.perl.org/users/ivan_bessarabov/2014/02/blogsperlorg-and-https.html don't happen.

[thaljef]

++ this. Today I saw that SSLs.com is having a 50% off sale.

I'd be happy to buy a cert for the next 5 years. Shouldn't be more than $25.

Just send me your receipt.

[joshrabinowitz]

It's 2019! Seems like this should get implemented?

In particular, the login page is not https protected. Also letsencrypt makes this less expensive and perhaps easier to setup than it was in previous years.

[davorg]

I agree with all of this. Particularly as browsers have started to warn on passwords on pages that are served over HTTP.

It seems that we have spent most of the last four or five years expecting this site to be moved to new technology on new hosting imminently. I still think that's relatively imminent, but I'll spend some time over the next couple of weeks looking at what we need to do in order to implement this.

[tobyink]

Any progress on this? Adding HTTPS support for a site isn't usually more than an hour's work.

[jberger]

I agree with @tobyink, I could even do the work: https://dev.to/joelaberger/no-magic-letsencrypt-certbot-and-nginx-configuration-recipe-3a97

[benkasminbullock]

Can the site maintainers please respond to the queries here?

[jberger]

Can the site maintainers please respond to the queries here?

At this point I assume no effort is being put into the site. As a result, sadly I've decided that it won't be worth my effort to put content here if browsers will be blocking it.

[ap]

The answer is basically “if you want to go there I would not start from here”. HTTPS support isn’t a lot of work to add – provided you are in a place from which it’s not a lot of work to add. The site is on a very old OS with crypto libraries so old it’s impossible to even connect to Let’s Encrypt, let alone obtain a certificate. I’ve checked. If that had been all that was necessary, I’d’ve done it a long time ago. Alas.

There is a bit of rabbit hole there. The site is on an expensive hosting plan, renting hardware that was high-end back when the site was set up. Moving the site is not an obvious endeavour because the way MT was deployed is basically “extract a tarball and fiddle around with it on the machine” and MT is a CGI-era design that doesn’t particularly separate user data from application code – everything just goes in the same tree and you have to know which parts are what. There are, at least, etckeeper records for the contents of /etc, but traceability is scarce aside from that.

That said, I’m shaving all the yaks. (Not least because I want to stop paying so absurdly much to keep the lights on! But when my bill goes down it’ll also mean SSL will be easy to enable.) It’s just a lower priority than my job and life in general (which have gone about as well as everyone else’s last year) – so yes, outward progress is slow.

(It doesn’t help that the progress I have made is going to make even less visible that anything is going on. Namely there are now countermeasures that finally make it impossible for spam to hit the front page. You might note that the spam reports filed in this issue tracker stopped dead a while ago. That’s where most of my energy went before.)

My ultimate goal too is not to just to move the site but to also make the setup repeatable and to have notes on all of it, which makes things slower than they could be. The upside is that ongoing effort should drop as I get everything where I want it to be, but to get there I have to dig my way a fair way to the surface.

(FWIW my two big visible goals are SSL and fixing the “session lost” bug when submitting from the comment preview screen.)

[jberger]

That said, I’m shaving all the yaks. [snip] so yes, outward progress is slow.

Honestly I'm just glad to see that anyone is working on it at all

[Grinnz]

Would one possibility for quick SSL be to have SSL termination on a separate device or service? (The NOC may even be able to help with this) That depends on whether there's a way to set this up without exposing the machine without SSL on the public internet, though it's not like that would be worse than the current situation anyway.

[jberger]

In addition to NOC, Cloudflare offers free ssl/proxy for open source projects. Both mojo and convos use it. That could also be an easy way to handle ssl in your case.

[jberger]

(Downvoting without comment is infuriating)

[ap]

@Grinnz

Would one possibility for quick SSL be to have SSL termination on a separate device or service?

It might – I’ve considered setting up the new hosting and proxying from it to the old server. It’s just that if that situation is going to persist for a while, it means I need to pay even more in the meantime. (And if that situation isn’t going to persist for very long? Then why go to the trouble.)

Cloudflare is an answer there. I’m just too much of an ideologue to feel comfortable handing them all “my” visitors on a platter. (My very first action as newly sole operator was to throw out Google Analytics…) So it’ll have to go the slower way.

I did also briefly look into other options like a proxy in a static-linked binary, so I could get something with contemporary crypto onto the machine without trying to update all of it. But I didn’t get anywhere within the amount of effort I was willing to expend on this.

But this issue is what I’m working on now when I’m working on b.p.o.

[benkasminbullock]

What kind of help can we offer you @ap? Do you want money to help with the server costs, or do you want volunteers to help with the coding or the system/webserver administration work?