Page 1 of 1

Forum will no longer display insecure images

Posted: Thu May 24, 2018 9:33 am
by xenopeek
A small change was done on the forum so that insecure images will no longer be displayed for most visitors. This avoids the mixed content warning visitors' web browsers would otherwise give them if an image in the topic they were viewing used a insecure HTTP link instead of a secure HTTPS link. This should mostly affect old topics as most image hosting websites these days use secure links.

Notably this change only works on standards compliant web browsers. Internet Explorer, and possibly very old versions of other web browsers, is unaffected by this change and will still display insecure images.

As a test I've added an insecure image of the Earth below this line. It shouldn't be displayed unless using a web browser that isn't standards compliant.
Image

Re: Forum will no longer display insecure images

Posted: Thu May 24, 2018 8:19 pm
by Spearmint2
that kills all images I post on my FTP site to forum.

Re: Forum will no longer display insecure images

Posted: Thu May 24, 2018 8:57 pm
by catweazel
Spearmint2 wrote:
Thu May 24, 2018 8:19 pm
that kills all images I post on my FTP site to forum.
Oh well.

https://imgbb.com/

Re: Forum will no longer display insecure images

Posted: Thu May 24, 2018 10:19 pm
by sdibaja
catweazel wrote:
Thu May 24, 2018 8:57 pm
Spearmint2 wrote:
Thu May 24, 2018 8:19 pm
that kills all images I post on my FTP site to forum.
Oh well.

https://imgbb.com/
nice gadget! thanks

Image
====
this forum needs BBCode
Image

Re: Forum will no longer display insecure images

Posted: Fri May 25, 2018 1:51 am
by xenopeek
Spearmint2 wrote:
Thu May 24, 2018 8:19 pm
that kills all images I post on my FTP site to forum.
Do you use that a lot? I can understand wanting to retain control over your images. You can of course post the link to an image on your FTP site. You just can't use it inside the img or rimg tags here. If you use it a lot and don't want to go the imgbb.com route I'd suggest to set up web server and use https://letsencrypt.org/ to register, and automate installation and updating, of a HTTPS certificate.

Re: Forum will no longer display insecure images

Posted: Fri May 25, 2018 6:59 am
by Pjotr
Good measure. A small discomfort, but it helps to build confidence in the security of the Linux Mint ecosystem. :)

Re: Forum will no longer display insecure images

Posted: Fri May 25, 2018 9:47 am
by Spearmint2
xenopeek wrote:
Fri May 25, 2018 1:51 am
Spearmint2 wrote:
Thu May 24, 2018 8:19 pm
that kills all images I post on my FTP site to forum.
Do you use that a lot? I can understand wanting to retain control over your images. You can of course post the link to an image on your FTP site.
Yes, link is what I use on another forum I frequent after they went to https images only. I may set SSL or TLS up on my server account someday, been too lazy to do it yet. I don't understand the purpose of going https for images.

Re: Forum will no longer display insecure images

Posted: Fri May 25, 2018 9:57 am
by trytip
Spearmint2 wrote:
Fri May 25, 2018 9:47 am
... I don't understand the purpose of going https for images.
it makes a full HTTPS website be in mixed mode (http/https) causing it to be less secure and have the ability for third party trackers to piggyback on these http links. same concept as using https everywhere addon

Re: Forum will no longer display insecure images

Posted: Fri May 25, 2018 6:58 pm
by MtnDewManiac
Spearmint2 wrote:
Thu May 24, 2018 8:19 pm
that kills all images I post on my FTP site to forum.
Can you use SFTP or FTPS? And, if so, would that work (for purposes of this discussion)?

Regards,
MDM

Re: Forum will no longer display insecure images

Posted: Fri May 25, 2018 8:12 pm
by Spearmint2
MtnDewManiac wrote:
Fri May 25, 2018 6:58 pm
Spearmint2 wrote:
Thu May 24, 2018 8:19 pm
that kills all images I post on my FTP site to forum.
Can you use SFTP or FTPS? And, if so, would that work (for purposes of this discussion)?

Regards,
MDM
an Idea, but I think the software in most forums just look for the https:// and my FTP server isn't an open one, meaning it needs name and password to access.

Re: Forum will no longer display insecure images

Posted: Fri May 25, 2018 9:50 pm
by AZgl1500
just checked, and www.imgur.com is https

Image

Re: Forum will no longer display insecure images

Posted: Fri May 25, 2018 11:18 pm
by trytip
imgur is both http/https so when posting here you have to make sure the s in https is there otherwise you will get the image holder only
Image

but shouldn't the link also be disabled?

Re: Forum will no longer display insecure images

Posted: Fri May 25, 2018 11:31 pm
by Spearmint2
trytip wrote:
Fri May 25, 2018 11:18 pm
imgur is both http/https so when posting here you have to make sure the s in https is there otherwise you will get the image holder only
Image

but shouldn't the link also be disabled?
They probably forgot to use the 301 area in their DNS to aim all http requests to https instead. It allows older http links to still work, supposedly, not tried it myself. Chrome 68 will label all http pages as "unsecure" and block them.

Re: Forum will no longer display insecure images

Posted: Sat May 26, 2018 8:42 am
by mwbworld
Really I'm as compassionate as the next person, but do we need to worry about the emotional state ("insecure") of images! :D

(I'll go sit in the corner now...)

Re: Forum will no longer display insecure images

Posted: Sat May 26, 2018 9:14 am
by Moem
mwbworld wrote:
Sat May 26, 2018 8:42 am
Really I'm as compassionate as the next person, but do we need to worry about the emotional state ("insecure") of images! :D
I'm the next person and I'm much more compassionate than you.

(I'll join you in the corner.)