There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

meonkeys ,

Hi! Author here. I added a http → https redirect to my book website, thanks all. I do intend to always serve public content via https to (as other smart folks have thoughtfully mentioned) guard against stuff getting messed with between my server and your browser (however unlikely that may be). In this case I thought my server was redirecting to https, but turns out my Firefox was forcing https (again, same as other smart folks said).

re: “expert”, ugh, I’m embarrassed to even use that word, but someone else graciously called me that (so I intended to remove “self-proclaimed”), and it supposedly helps for sales. All I know is I’m growing and learning just like you, the more I know the less I know I know, and I make mistakes all the time. I always appreciate kind corrections/feedback/comments/patches/suggestions/etc.

That includes feedback on github.com/meonkeys/shb/blob/main/…/.htaccess … I feel clever fixing two things in a single redirect (getting rid of www. and forcing https), but I’m not sure if I’m doing something silly or dangerous here. I’m definitely not an expert at Apache mod_rewrite, I just cobbled that together from official docs and stackoverflow posts.

perishthethought OP ,

Hi author! I’m Dad. :)

Thanks for joining the conversation. I thought it too much to hope you’d be on Lemmy but glad you are! Thanks for adding those bits about https, but I was saddened to see that 90% of the conversation around this centered on that one side topic.

I’ve only read the TOC for your book so far but it seems very much what we need to see more people adopt self-hosting so thank you very much for putting in the time and effort!

Decronym Bot , (edited )

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters
HTTP Hypertext Transfer Protocol, the Web
HTTPS HTTP over SSL
SSL Secure Sockets Layer, for transparent encryption
TLS Transport Layer Security, supersedes SSL
nginx Popular HTTP server

[Thread for this sub, first seen 16th Jun 2024, 20:05] [FAQ] [Full list] [Contact] [Source code]

homesweethomeMrL ,

Cool, thanks for the link!

dislocate_expansion Bot ,

Hopefully the author explains how to use SSL/TLS since their site doesn’t :/

perishthethought OP ,

They do, via Traefik. Chapter 8.

Maybe they decided there was nothing that requires an SSL/TLS certificate on this particular site? (They accept payments elsewhere).

kambusha ,

How do you know that if you’ve never read it?

perishthethought OP ,

Because I clicked the link and read the link at the top which says “Code”. The book’s contents are open source. :)

Though I think everyone who can afford to and wants a copy should consider buying one. As an author myself, I know this author would prefer that option, but they’re being very cool by sharing the contents online too.

github.com/meonkeys/shb/…/steadfast.asciidoc

EncryptKeeper ,

It’s because you linked to the site using http://. This is something the site should account for, but doesn’t.

ilmagico ,

The site does use https for me… it instantly redirects from http to https

GravitySpoiled ,

Sounds like the robot guy doesn’t use https only mode

EncryptKeeper ,

Your browser is redirecting, the site is not.

ilmagico ,

That’s possible, I’m using Firefox, is that something firefox would do?

msage ,

Yes, there is/was a setting for that, should be on by default.

AlexanderESmith ,

I might have missed it, but it doesn't look like their site accepts payment data, or has a login of any kind.

Why would the lack of SSL concern you?

EncryptKeeper ,

The site is encrypted but you can also access the site over http. The author hasn’t configured any kind of HTTPS upgrade. This is an easily correctable oversight that a self proclaimed “self hosting expert” should have accounted for.

possiblylinux127 ,

They should just block port 80

EncryptKeeper ,

Or not have the website listen on port 80, or redirect connections from http to https on connect. Lots of very simple ways to correct this problem.

possiblylinux127 ,

Why wouldn’t that concern you? That means it is totally plain text with zero verification of incoming data or encryption. It is really easy to tamper with http traffic.

witten ,

The site links to a site that accepts payment data. So because the author’s site is http, a MITM attacker could change the payment links from lulu.com to site-that-actually-steals-your-credit-card.com.

That’s one huge thing https provides over http… assurance of unadulterated content, including links to sites that actually deal in sensitive data.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • [email protected]
  • random
  • lifeLocal
  • goranko
  • All magazines
    •