Forum problems 10 April 2015

[ben_nuttall]

Hi everyone

We were experiencing some issues with the forums this morning: Links from Google and links in forum emails were being broken.

These issues have now been resolved.

[RaTTuS]

Thanks ben - bet that was fun

[gkreidl]

Hi everyone

We were experiencing some issues with the forums this morning: Links from Google and links in forum emails were being broken.

These issues have now been resolved.

This morning? All day yesterday! And the RSS feeds are still not working: they have to be directed to https, I suppose, but that doesn't work right now.

[Fidelius]

And the RSS feeds are still not working: they have to be directed to https, I suppose, but that doesn't work right now.

I can confirm this problem.

[plugwash]

We were experiencing some issues with the forums this morning: Links from Google and links in forum emails were being broken.

That's something of an understatement,basically all links to forum pages other than those generated by the forum software itself were broken by a broken redirect from http to https which was incorrectly escaping things that should not be escaped (most notablly the equals signs in query strings). The problem also started much earlier than you implied.

[DougieLawson]

Can someone explain the point of using HTTPS rather than HTTP (other than a way to slow the forum down)? It makes no sense to me.

[RobHenry]

[quote="DougieLawson"]Can someone explain the point of using HTTPS rather than HTTP (other than a way to slow the forum down)? It makes no sense to me.[/quote]

It prevents NSA snooping and guarantees the authenticity of the forum content.

[DougieLawson]

Can someone explain the point of using HTTPS rather than HTTP (other than a way to slow the forum down)? It makes no sense to me.

It prevents NSA snooping and guarantees the authenticity of the forum content.

And we need that because ...?

[RobHenry]

Can someone explain the point of using HTTPS rather than HTTP (other than a way to slow the forum down)? It makes no sense to me.

It prevents NSA snooping and guarantees the authenticity of the forum content.

And we need that because ...?

I didn't say we need that, but that's what we get...

[ShiftPlusOne]

NSA is the last thing people should be concerned about. This prevents plain text data (like your password) from flowing across your network and to the server and also verifies that the site hasn't been hijacked.

Also, if the site is having issues, the best thing to do is to report it and then do something else. Getting nasty about it isn't helping anyone. When the foundation has Google's resources, upgrades may go more smoothly.

[plugwash]

Can someone explain the point of using HTTPS rather than HTTP (other than a way to slow the forum down)? It makes no sense to me.

More and more people use the internet on the move these days, and often connect over insecure connections (GSM encryption has been cracked, most public wifi is either unencrypted or running in psk mode with a key that is readilly available to attackers). Plain http makes it trivial for such attackers to sniff passwords and session cookies and hence potentially take over user accounts.

Using https makes it much harder for attackers to do this. Enabling strict transport security and key pinning would make things harder still for the attackers. I don't know if the rapsberry pi foundation have done this or plan to do so.

[plugwash]

And the RSS feeds are still not working: they have to be directed to https, I suppose, but that doesn't work right now.

hmm, the rss feed for the blog seems ok to me (on http it redirects to https as expected) and I can't seem to find any evidence that rss feeds exist for the forum, am I missing something.

[morphy_richards]

A paranoid educational internet provider filters all https traffic because erm ...I don't really know why, something to do with politics. Google translate is now unuseable for me at work since they switched to https. It seems it might be used to access facebook in Esperanto.

Just to make it clear, I blame the filter service provider but its a potential issue for an educational foundation if they get filtered out by default.

[gkreidl]

And the RSS feeds are still not working: they have to be directed to https, I suppose, but that doesn't work right now.

hmm, the rss feed for the blog seems ok to me (on http it redirects to https as expected) and I can't seem to find any evidence that rss feeds exist for the forum, am I missing something.

Yes, you are missing the forum RSS. They are built into phpBB and my browser (Opera) shows them in the URL field. I just discovered the feeds a few weeks ago and it was a much better way to follow the forum for me (setting the update to 5 minutes). But now I don't get updates any more. Somebody has to fix this in the phpBB admin settings.

[Paul Webster]

The old semi-official link still works to get content
http://www.raspberrypi.org/forum/feed.php
Note - forum not forums and not https
However, clicking links within then has the http/http problem.

[r3d4]

The old semi-official link still works to get content
http://www.raspberrypi.org/forum/feed.php
Note - forum not forums and not https
However, clicking links within then has the http/http problem.

Just cicked a few and they worked ,so looks like any the gremlins have been exposed to th sunlight light.

[gkreidl]

The old semi-official link still works to get content
http://www.raspberrypi.org/forum/feed.php
Note - forum not forums and not https
However, clicking links within then has the http/http problem.

Just cicked a few and they worked ,so looks like any the gremlins have been exposed to th sunlight light.

At the moment the RSS feed is updating again, but it didn't yesterday.

[Bruny]

something new?
Your connection to [this forum] is encrypted with obsolete cryptography

[kusti8]

something new?
Your connection to [this forum] is encrypted with obsolete cryptography

Yeah, looking at chrome, it says:

Your connection to www.raspberrypi.org is encrypted using an obsolete cipher suite.

The connection uses TLS 1.2.

The connection is encrypted using AES_256_CBC, with HMAC-SHA1 for message authentication and DHE_RSA as the key exchange mechanism.

Don't know anything about cryptography, but it shouldn't affect anything. I can browse the forum fine.

[Bruny]

Don't know anything about cryptography, but it shouldn't affect anything. I can browse the forum fine.

yes, I have more trouble with some plain text shops

[plugwash]

something new?
Your connection to [this forum] is encrypted with obsolete cryptography

From some googling it looks like it's a new version of chrome doing it. Might be worth one of the server admins fixing the server config.

It looks like the specific problem is that the server is only offering cipher suites that use 1024 bit diffe-hellman which is now considered relatively weak (e.g. right now breakable by state-level attackers, and quite possiblly breakable by other people in the not too distant future). .

https://www.ssllabs.com/ssltest/analyze ... 93.128.211