A user, dylanh724, shared an image of a warning message that invitees received, stating that the site is not secure and could be compromised. The user suspects that this message is coming from Discourse and suggests adding a warning before sending out mass invites if the site doesn’t have SSL.
However, codinghorror clarified that the warning is actually from the browser, not Discourse. dylanh724 still recommends adding a warning for non-SSL sites to avoid embarrassment.
codinghorror noted that the warning is Firefox-specific and that Chrome only shows a general warning in the address bar. fefrei suggested adding a check to the admin dashboard to discourage non-HTTPS installs for security reasons.
Others, such as jomaxro, pointed out that there may be situations where HTTPS isn’t feasible, such as internal sites not visible outside the company network. In these cases, a dashboard warning could be obnoxious and would need to be disableable.
Additionally, pfaffman mentioned that getting HTTPS is easy with Let’s Encrypt, which can be set up by running discourse-setup again and providing an email address.
If this was from Discourse, how about a warning before you send out mass invites that they’ll receive a scary sketchy SSL warning with a recommendation to get SSL before inviting out?
We only launched our forum not long ago and were planning to get SSL in a few weeks. I would’ve definitely waited. It’s sort of an overdramatic message, as this applies to any site without SSL (http).
Even if it’s browser based then… should still show a warning that some browsers may do this. However, just a heads up - this sucks after sending out 2300 invites from our mailing list don’t let others make my mistake.
SSL is great practice – i have it for all my sites except my forum because it’s newer and haven’t got around to it yet.
Yea I had a feeling – however, because browsers do this, I still encourage adding a warning if !SSL. It’s quite embarrassing who would’ve known. I know it’s not a Discourse thing, but it may help future people.
I believe what you showed is Firefox specific. Chrome just shows a general warning in the address bar. Firefox’ market share is way, way down from where it was 4-5 years ago.
Maybe we should take this as the last nail in the coffin to add a check to the admin dashboard as long as HTTPS isn’t enabled? I’d highly discourage non-HTTPS installs for security considerations alone…
I can still think of at least one situation where this isn’t feasible - internal sites that aren’t visible outside the company network. Let’s Encrypt can’t work for those sites, and a constant dashboard warning would be quite obnoxious. There would need to be a way to disable it for situations like these if we add a check to the dashboard.
don’t let others make my mistake.
who would’ve known. I know it’s not a Discourse thing, but it may help future people.