2

I saw this item in The BBS chat room and clicked on it:

screen shot of link

A window opened up with a google security message (I'm using Chrome on OSX):

screen shot of error message

I understand I can override by going to ADVANCED and saying "ok", just curious if this indicates some issue or is superfluous.

edit: fyi I noticed the link is to meta.retrocomputing and not retrocomputing.meta

  • I was slightly startled by this only because I've never seen it anywhere else on stackexchange – LateralTerminal Nov 13 '17 at 20:24
  • @LateralTerminal neither have I. It's an interesting edge case for sure (see explanations below). Image hotlinking is a broader (but mostly unrelated) topic; security.stackexchange.com/a/168859/115702 – uhoh Nov 14 '17 at 2:04
2

This is an old link.

A little while ago, StackExchange changed from using http to https to improve security. At the same time, addresses of the per-site metas changed from meta.site to site.meta.

Your browser is just warning you that you are following a link to an older http connection from an https connection.

Some other StackExchange sites have systematically updated internal links to correct this. Largely because some sites had dozens or even hundreds to fix. We don't have very many so suggested edits are welcome on any that you see. However, this isn't so easy for logs of chat.

So, not it isn't a security problem to worry about, just an artifact of the change to https:.

  • While I'm not very http vs https savvy, I've noticed a lot of behind-the-scenes manual edits to links in SE questions in various sites by diligent users in the last year or so. Thanks for the thorough answer! – uhoh Nov 12 '17 at 11:34
  • @uhoh If I understand correctly, plain HTTP can be snooped by anyone within the same TCP/IP subnet you are (typically up to 256 users/subnet) or someone unethical at your internet provider. Anything you type is plain text; HTTPS would cryptically encode this traffic. It's usually not a big deal unless you are sending personal information or something you would be embarrassed if others read. I doubt a post on SE would fit either criterion. Plus even if they could read it, without identifying info, they likely couldn't match a specific TCP/IP address to an individual. – RichF Jan 3 '18 at 0:25
  • @RichF In the field of internet security, "usually not a big deal" is not a helpful concept or a good sentiment to pass on to others. Terms like "best practice" are better. – uhoh Jan 3 '18 at 0:45
  • @uhoh Heh, I guess I've been a little salty about this specific "best practices" topic since Google Analytics warned me that continued use of HTTP on my site could lead to downgraded placement in search results. My site doesn't even receive input from visitors -- there is only borng stuff to read and see (... which can also lead to downgraded placement 🙄). I was especially bummed because at the time (and maybe still) my hosting service charged extra to use HTTPS, which for me and my visitors, would be done not for security but to satisfy somebody's idea of "best practices". – RichF Jan 3 '18 at 1:02
2

Sorry; this is my fault.

I posted this link before HTTPS was deployed across the Stack Exchange network. At that time I often used protocol-relative links so that people who were using HTTPS would be given HTTPS links but those using HTTP (obviously for a good reason) would be given HTTP links. At this time I was largely using chat through HTTP, so didn't notice that there wasn't a valid HTTPS certificate for meta sites due to limitations in the certificate system. I have now fixed this particular error.

Incidently, you wouldn't happen to want to write an article for the blog?

  • "fault" may be to strong a word here, thanks for the answer! OK I will take a look and see what's there. :-) – uhoh Nov 12 '17 at 11:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .