Kitz Forum

Announcements => Site & Forum Discussion => Topic started by: highpriest on November 05, 2017, 10:27:06 AM

Title: HTTPS By Default
Post by: highpriest on November 05, 2017, 10:27:06 AM
Please? :)
Title: Re: HTTPS By Default
Post by: d2d4j on November 05, 2017, 10:59:18 AM
Hi highpriest

I know it’s actively in progress but no time frame as other areas are in progress first

I hope everyone/most will appreciate it is not a click box and a lot of work is involved to ensure all will be https ie external links etc...

I am sure when kitz is ready, we all will be made aware

I hope kitz does not mind my post but please delete if you need to sorry

Many thanks

John
Title: Re: HTTPS By Default
Post by: roseway on November 05, 2017, 11:15:26 AM
Thank you John, that's quite right.
Title: Re: HTTPS By Default
Post by: kitz on November 05, 2017, 01:54:03 PM
I hope kitz does not mind my post but please delete if you need to sorry

No not in the slightest - Thank you.   The structure of the site means there are a lot of external factors to consider and there isnt an overnight solution.   
Still not 100% sure how Im going to proceed as regards to either paying my hosts to manage some of it or using let's encrypt...  but there will likely have to be some sort of proxy because of forum images etc.

John is one of the few who knows it is under progress, as with him being in the hosting business himself I had asked his opinion on the best way to proceed with this a while ago.

He is also aware of the development work going on behind the scenes regarding making the main site responsive.   This is a massive project - there's 100's if not 1000's of pages if you include all the .php dependencies.   
There's only one of me, not helped by the fact some days I find it difficult to type so you can imagine how slow coding is. 


----

I have looked as various CMS even installed a few and thought I was going to use Joomla, then found MODX may be better.   Installed MODX on my server..  started trying to build the front end...  then realised because it was all database driven I have a massive problem when it comes to some of the site urls and naming...  and it is not going to work well with certain pages such as the broadband checker.

So back to the drawing board and using a template system.   Thought I'd found something whilst it will let you add pages to a single template system, it doesnt manage templates (re updates!)... but hey it was 'cheap' at under £100 , but then I found it broke all php <?> tags.  Luckily I found that out before I'd progressed too far and paid for the full version.   

If the site was new then starting using something like MODX or Drupal would be the way to go.  (That in itself is a learning curve). 
But it isnt -  and there's about 14 years of content with a custom built back end system.    There is no easy way.  Its not a WP type site which works well for blogs, but certainly does not for tutorial type things which needs a proper menu navigation.  There's far too many pages already indexed with search engines using static urls rather than "php?page=1".  There's also the subfolders eg /adsl or /routers issue to be overcome. 
So I'm spending quite a lot of time at W3C and having to do my own grid layout.    They grid layout is almost finished.  I have a menu system that works.  Next will be transferring all content pages to W3.CSS responsive.   That in itself could take time as it will have to be done a page at a time.    When that is done, then the new site can be launched as https.

[Moderator edited to correct a minor typo.]   
Title: Re: HTTPS By Default
Post by: highpriest on November 05, 2017, 06:32:13 PM
Thank you all. Hope the upgrade work goes smoothly :thumbs:

Is the use of a CDN not possible for a website/forum like this?
Title: Re: HTTPS By Default
Post by: kitz on November 05, 2017, 07:30:44 PM
No.   I struggle to pay server costs nvm CDN  :'(

If you mean CMS I covered that above.  No word of a lie Ive spent months trying to find a suitable replacement, even wasting a few weeks messing with MODX before realising it wasnt going to work right.
   
Forum would still need some sort of proxy though for external images.  I had been waiting for latest version of SMF (which has been recently released) which makes things quite a bit easier in respect of the forum.  However it is and always has been the main site which is much busier than the forum.

Believe me, if there was an easy option then I'd do it.   Unlike other sites of this site, there are no paid staff, ad revenue is practically zilch atm 'cause everyone uses adblockers.  Even TBB has a team who works behind the scenes responsible for Admin and web side of stuff.  Same with ISPr who have a content team.   Me I have to do everything for nowt with grateful assistance from Eric and Alan who help on the forum side of things when it comes to moderation. 
Title: Re: HTTPS By Default
Post by: highpriest on November 06, 2017, 01:29:30 AM
No, I meant a CDN like Cloudflare, MaxCDN or Amazon CloudFront. Cloudflare offers a free plan as well (with a free shared SSL certificate). They will cache most static content so your bandwidth overhead should reduce significantly.

Not really my area of expertise though, so apologies if I'm way off the mark here.
Title: Re: HTTPS By Default
Post by: jelv on November 06, 2017, 09:10:09 AM
Is there a traffic limit on the Cloudflare free plan?
Title: Re: HTTPS By Default
Post by: nallar on November 06, 2017, 09:43:02 AM
There is no strict limit. I've never heard of anyone's free plan being terminated/forced to upgrade, but the terms would allow them to kick someone off. I expect kitz.co.uk would not reach enough usage to run into that problem.

The full terms are here: https://www.cloudflare.com/terms/
Title: Re: HTTPS By Default
Post by: highpriest on November 06, 2017, 10:12:35 AM
What nallar said :)

Even if Kitz goes for the $20 a month plan (Pro), the overall running cost could drop as a) the bandwidth bill could drop significantly (https://livinglifetechway.com/how-cloudflare-saved-bandwidth-and-kept-my-blog-up-in-traffic-spike/) and b) the site potentially could be run on a smaller server/VPS if the load drops by enough of a margin.
Title: Re: HTTPS By Default
Post by: roseway on November 06, 2017, 10:52:46 AM
Come on guys. I know you want to help, and it's appreciated, but Kitz has researched this very thoroughly, and as she said above "if there was an easy option then I'd do it". The main site is very busy and has complicated interactions with other sites. It's definitely not a simple job.
Title: Re: HTTPS By Default
Post by: highpriest on November 06, 2017, 11:12:32 AM
I know; I wasn't trying to trivialise the effort that might be involved.
Title: Re: HTTPS By Default
Post by: kitz on November 06, 2017, 12:11:20 PM
There is no strict limit. I've never heard of anyone's free plan being terminated/forced to upgrade, but the terms would allow them to kick someone off. I expect kitz.co.uk would not reach enough usage to run into that problem.

The full terms are here: https://www.cloudflare.com/terms/

Page rules is the problem.  Far too many pages have dynamic content and would just pure and simply break.

For starters:-
Front page of main site
Broadband checker
Lots of the ISP pages & the ISP price pages.
All of the rating system pages.


Theres also something else major which would break that Im not going to discuss in public but the upshoot is even 20 page rules would not suffice.
$200 pm is too much of an additional burden. 




Title: Re: HTTPS By Default
Post by: nallar on November 06, 2017, 01:29:18 PM
> It is possible to set the "Browser Cache Expiration" setting to "Respect Existing Headers" meaning Cloudflare will not override or insert a Cache-Control header (unless told to do so by a specific Page Rule).

https://support.cloudflare.com/hc/en-us/articles/200169266-Does-Cloudflare-honor-my-Expires-and-Cache-Control-headers-for-static-content-

When set to "Respect Existing Headers" cloudflare will only cache pages when your server sets cache-control/expires headers to allow it, instead of doing it by default.
Should be no need to pay for page rules that way.
Title: Re: HTTPS By Default
Post by: Chrysalis on November 06, 2017, 06:34:51 PM
yeah I suggested cloudflare to kitz a while back which she may remember and it was explained to me the limitations of cloudflare is an issue with the complexity of the site.

nallar's idea might be worth looking into tho if not previously considered.
Title: Re: HTTPS By Default
Post by: celso on November 07, 2017, 04:48:01 PM
Cloudflare doesn't cache html content by default (it always fetches pages from origin), so unless you want CF to cache pages, the 20 page rules included on the Pro plan should be enough to force them to cache images/js/css/etc and enable security features for important areas of the site (eg: admin). And as @nallar said, it's possible to keep the existing headers.

I've used ~80TB/month on a Pro plan for a few months before they contacted me to upgrade... so yeah, this plan should be enough. Anyway, does a website like Kitz, where costs are an issue and users come from the same place were the server is hosted, needs a CDN?

Many websites use Cloudflare because they offer a "flexible ssl" option were the connection between the user and CF is encrypted, but between CF and the origin server is not. It's easier for the website owner, but this creates a false illusion of security... and sometimes funny things happen (https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflares-traffic-in-india-and-they-don-t-even-know-it-90935f7f6d98). Not 100% sure, but TBB seems to be doing this.
Title: Re: HTTPS By Default
Post by: kitz on November 07, 2017, 06:39:42 PM
Whilst I do appreciate suggestions, sorry this is a no.   
I did spend quite a bit of time looking into it a while back when Chrys mentioned it.   Whilst I appreciate that cloudflare may work very well on WP type sites, I don't feel that it would be of much benefit here.  It's not just one thing - there are several reasons why.

Quote
Not 100% sure, but TBB seems to be doing this.
I'd doubt it.  Seb owns NetConnex.   They're right in Telehouse.   
If you're based in the UK right at the co-lo and your target audience is UK based then that negates one of the reasons for using a CDN.
He has no need to worry about bandwidth or servers..  he owns a shedload of them.

I deliberately chose UK hosting for the same reason.  If you're using shared hosting abroad then CF is probably brilliant. 

You can usually spot sites straight away who use CF.   Reddit does.  Teamspeak (http://www.teamspeak.com/en/teamspeak3) is another that Ive seen it on.   Note how slow it is the first time you visit and sometimes you even see weird messages about checking if youre a bot.   First time I saw it I wondered wth was going on which is how I know reddit uses it.

Title: Re: HTTPS By Default
Post by: celso on November 07, 2017, 07:38:09 PM
I agree, a CDN is not needed in this case.

TBB uses Cloudflare (https://i.imgur.com/hOhZxth.png) on their main website, but not on the forums/other subdomains. I think they are using Cloudflare's flexible ssl because their speedtest page was, until a few days ago, available only via http while the other pages were using https. This suggests that the backend (cf <-> server) is (was?) not secure. I only mentioned this because we teach people to trust the green padlock, but even with https we don't know if the connection is really secure...

(btw, reddit and imgur moved from Cloudflare to Fastly 1-2 years ago)