17

TL;DR:

  • Links in off-topic close reasons are not HTTPS.
  • Links to other sites in migration close reasons are not HTTPS.

NB: This question is tagged "custom close reasons". Those include both the free-form close reasons users can provide, and the per site templated close reasons. I don't know if free-form close reasons also have this problem; I haven't tested it yet, and am reluctant to.

I did a spot-check of a few sites, and this is true for every site I checked.


I'm occasionally active on CodeReview.SE. That means closing questions every now and then (there really aren't that many off-topic ones, thankfully). While I was casting my close-vote, I wrote a comment to let the person know what they'd done wrong, so that they could try to fix it. To help, I copied a link from the off-topic close-vote reason, pasted it, and noticed that it started with http://. Given Stack Exchange's recent migration to SSL, this surprised me, especially considering this bit:

Cleanup all existing user content that was http:// (https:// where possible, and converted to links if we can't embed it securely).

and it being marked with done. While I understand that close reasons are an... esoteric bit of user content, they are still user content, and should probably be retroactively modified. At the very worst, a mass-email to the mods of every site would probably get it changed within a day; there are (if I'm remembering correctly) at most 5 site-specific close reasons. Apparently, that won't work. We need a dev to go in and change them directly.

The generic ones that all sites have are correctly migrated to HTTPS. However, none of the 3 close reasons on CR uses HTTPS links, and the Off-Topic > Migration options don't seem to, either.

I did a spot-check of a few other sites, and this is true for every site I checked.

  • No repro in this question's flag dialog or close dialog. Repro in the off-topic close dialog. – John Dvorak Apr 22 '17 at 15:31
  • 11
    Ugh, yeah. Pretty much all the custom off-topic reasons are going to be HTTP links because they were likely written that way when they were created on-site (those aren't generated by the system but are just saved Markdown). They'll all have to be edited by devs (not recreated by moderators, so that the changes will retroactively apply to older posts previously closed with those reasons). – animuson Apr 22 '17 at 16:20
  • 1
    Can confirm on Stack Overflow, Super User, Software Engineering, Arqade and meta sites for each of them. There are also several links to stackexchange.com/sites on the "should be closed" descriptions on meta sites. – Filnor Oct 4 '17 at 10:36
  • @animuson We appear to have a case of this http-vs-https confusion mentioned on ELU’s meta. Is bugging a dev to edit the old one to make it appear to have been https all along worth the trouble? – tchrist Jan 14 '18 at 21:28
  • @animuson Doing another brief spot-check on SO and CR, this seems fixed. If that's the case, could you write up an 'official' answer? Or at least status-completed the question. – Nic Hartley Sep 3 '18 at 21:15
  • 1
    Not yet fixed on Science Fiction & Fantasy. Some links use https, some links use http, some links are protocol-relative. – SQB Sep 5 '18 at 15:15

You must log in to answer this question.

Browse other questions tagged .