Unable to set HTTP url in profile (looks like only HTTPs allowed)

[wp0]

subj.

One of things that annoys me about "modern" web is that HTTPS is enforced everywhere.
When I go to my profile on this site, I can put my website there... But only if it is https!

Grrrrr

UPD: I mean, for my site URL in my profile, in this forum profile settings

[schlime9k]

Yeah, it can be annoying but it is important that HTTPS is heavily supported because of its more secure protocols. Plus it's just the difference between a site that has an SSL/TLS cert on their web-hosting service and one that doesn't, which is easy to do, so there's no real benefit to not adding it in and making your site more secure for both yourself and your fellow netizens visiting your site.

Even if you may not want this because of one reason or another, such as less data overhead due to the packets being sent as plaintext only, lack of worry over certificate management or -- the only valid benefit I see to http over https -- legacy OS/browser support; it's more beneficial overall to make your site HTTPS.

The thing is, you can have your site's server listen for both HTTP and HTTPS connections simultaneously on different ports. This negates the annoyance entirely, so if you want both legacy and modern support, there ya go!

[Melooon]

Thanks for your post schlime9k! That is a good list of reasons why https is a good idea to use, I'd also add it makes embedding sites in the surf club work a bit better since most sites are https now, so embedding http content in a https site can cause issues.

HOWEVER @wp0 thank you this was an actual bug tooo! A few months ago I tried to enable full http support on the forum for old browsers and it went horribly wrong and broke everything, so I then I tried to make it https again, but in the process a lot of http features got mixed up - I'm still trying to iron them out! Profiles should work for http now 

[arcus]

A few months ago [...]

It might have been something else. I reported this bug at the start of the year: https://forum.melonland.net/index.php?topic=31.msg49066#msg49066

[Dan Q]

If anybody's on the fence about it, I did a whole thread about HTTP vs HTTPS and whether you should use the latter.

My personal feeling is that:

(a) everybody should be using HTTPS: the cost (in processing, in certificates, in administrative overhead etc.) is nowadays effectively zero, and even a "read only" personal website benefits from the security (inability for attackers to easily "inject" content), privacy (inability for attackers to sniff what your visitors are reading), performance (HTTP/2 and HTTP/3 are faster but effectively require HTTPS), and features

(b) nobody should be FORCED to use HTTPS: I'm opposed to the gating of arbitrary browser features behind HTTPS and search engines de-ranking HTTP websites. HTTP is very simple (you can access it via a dumb connection e.g. using a telnet client), the most-widely-supported (all the way back to the very earlier browsers), and "good enough" for many people.

I'm aware that there's a conflict in my opinion there, and I'm okay with it!

[wp0]

Sorry all, it was poor wording on my end :D I did not mean I expect this site to operate on HTTP over HTTPS.

I meant precisely what @arcus here mentions: in my profile settings, there is a profile setting to give address of my website, and it silently swallows http address if you enter it there - just blanks itself



Topic aside, I agree on nobody should be FORCED to use HTTPS take though. And also I understand fully why do they (google mainly) force it though: tech illiterate people don't know better, and most internet users are that... Btw, on older machines there can be older TLS version (and it's usually a part of an OS, you can't just install a newer TLS) that would prevent most sites from working mainly because they exclusively serve HTTPS... But then again, those probably don't have browser that has, say, CSS vars that this site uses heavily :D

[schlime9k]

Thanks for your post schlime9k!

Thx melon <333

I'm aware that there's a conflict in my opinion there, and I'm okay with it!

I don't think there's a contradiction in your opinion, you can want everyone to support something without them being forced to, like you can want someone to, say, use toilet paper (weird analogy, I know) without saying "you have to use toilet paper." It'll then be up to the user on whether they see the benefit or if it meets their needs, which in the case of HTTPS and toilet paper, they probably will.

I aggree on nobody should be FORCED to use HTTPS take though. On older machines there can be older TLS version (and it's usually a part of an OS, you can't just install a newer TLS).

'sactly! HTTP should still definitely be supported because of this exact reason! SOOOO many computers at my university (mostly in the science dept.) is on Windows XP/7 or older, and use HTTP to be able to use old API stuff and retrieve papers on the line! If HTTP were to die out (highly unlikely but a possibility) then all those computers would be practically useless...

[Dan Q]

you can want someone to, say, use toilet paper (weird analogy, I know) without saying "you have to use toilet paper."

If you're trying to tell us that you don't use toilet paper you can just come out and say it, we don't mind.

Windows XP/7 or older

You can probably get back further than that. Much, much further. Firefox 52.9 ESR (2017) runs on Windows XP: it supports TLS 1.2 (and, behind a feature flag, TLS 1.3) which means it ought to be able to access basically any modern HTTPS connection without any difficulty. It might not receive the latest CA certs (same applies to everything else I list below) so it e.g. might not have the 2026 Lets Encrypt root CA change, but that can be installed separately and will Just Work.

Sticking with Firefox because I know my way around Mozilla's release notes, Firefox 24 ESR (2014) supported TLS 1.2 (behind a feature flag), which is sufficient for almost-every HTTPS website (including this one!).

There's also a slightly-hacky way to take the patch that added TLS1.2 support into Windows Embedded POS (cashier checkout terminals) and applying it to Windows XP to give it full, built-in operating system level TLS1.2 support all. So yeah: Windows XP can be made to "just work" with modern HTTPS, even if you're using IE (though, umm... don't?).


Okay, let's go back further than that. Suppose you're running MacOS 8.6 or 9.0 (both from 1999): Firefox clone Classilla - whose last release was in 2021! - supports the very latest versions of TLS: how cool is that? In fact, anything that can run the underlying toolset Crypto Ancienne and supports SOCKv4 can proxy its HTTPS content through a downgrading-reencrypting-proxy. This means that (on a PowerPC or similar hardware) should let you use any browser that'll run on anything as old as Solaris 2 (1991) or BeOS (1995) or what-have-you... though I can't imagine that the processing power of these devices would make it very pleasant!

Switching back into x86-land... you can patch TLS into Winsock and make it work on Windows 3.x variants! And Links for DOS supports TLS 1.2 and ought to work as far back as MS-DOS 5.0 (1991).

So yeah, my thinking is that any computer built after the Web was invented can probably be made to download data from modern HTTPS websites. It might not be easy; it might not be fast; it might not be pretty; and it almost certainly won't handle modern HTML, CSS, and JavaScript in some of them... but it can be done!

[Rubbereon]

Yeah, it can be annoying but it is important that HTTPS is heavily supported because of its more secure protocols. Plus it's just the difference between a site that has an SSL/TLS cert on their web-hosting service and one that doesn't, which is easy to do, so there's no real benefit to not adding it in and making your site more secure for both yourself and your fellow netizens visiting your site.

Even if you may not want this because of one reason or another, such as less data overhead due to the packets being sent as plaintext only, lack of worry over certificate management or -- the only valid benefit I see to http over https -- legacy OS/browser support; it's more beneficial overall to make your site HTTPS.

HTTPS is not far more secure than HTTP, all it does is it encrypts your connexion. HTTPS makes no guarantee that the site you are visiting is safe or that you will never get hacked or stalked.

Plus, a SSL certificate only matters on web 2.0 and above (web 3.0 with the fediverse and the blockchain and that's it unless they make more of these). If somebody, let's say Joe, runs a static web 1.0 website then the cerificate is useless because what are bad actors gonna do about it? Oh yeah sure let's man-in-the-middle attack some dude visiting a website that has no login screen whatsoever. Joe is just looking at a C# tutorial for Unity and he's about to leave and in the meantime they got nothing useful outta Joe.

You could say, "but then they use javascri-" BUT browsers are so secure by design that anything more than a spyware tracker is not gonna work. Wannacry happened in 2017 and I think that by now the developers working on the browser(s) have gotten wise enough to not let scripts run arbitrary code to install malware, so something like that could never happen again. (and to be clear, the wannacry attack worked differently, it first infected websites, so that they would then infect the end-user. In that scenario, HTTPS provided no benefit against it)

In 99.999% of cases you should still get a SSL certificate (which increases to 100% if your website is not static i.e. it is a forum, it has login or anything else of the sorts), but I say that only so your website looks more reputable. Having no certificate can cause your website to sink in the search results as either "obsolete", in other words old, or Google and whatnot may think your website distributes malware, is fake or is illicit and so hides it as a preventative measure.

However with that said and with the context of the original post in mind, I don't believe anybody should be forced to install a certificate especially on a yesterweb retro website. Certificates can cause untold amounts of problems which is something that partly scares me against going full self-hosted because methinks I'll give up due to stress and frustration. It's not meant to be exhaustive, but it is a very large number of problems that can arise when your site has HTTPS:

• Like you said, SSL certificate have support issues on older machines and older browsers.
• A website's css and js is broken because somehow it's not encrypted and the certificate treats it as some third-party injection (can be fixed by embedding it directly into the html file, but it's a bad thing either way). This is an intended part of the SSL protocol to protect the end-user from bad javascript from man-in-the-middle attacks, but fixing it requires some level of technical knowledge that the op may not have (I don't either tbh).
• The worst one, WORSE than no SSL at all: Your SSL ceritificate has expired, so now all the browsers ever made around the world will blare the fire alarm and it takes clicking on read more and proceed to even access the website and the way this screen pop ups will scare the average normie into LEAVING your website thinking that they might get a virus. At least the no SSL warning screen is not nearly as dramatic. What makes this of all things so frustrating is that it is yet another thing to worry about if you want your website online, your annual renewing of hosting sub, domain name and now the SSL certificate all in one package.
• You moved domains and now you get the same a similar error as above because the domain doesn't match the certificate's specifications. That's a real issue I know of, but the specifics I'm completely in the dark about them, so I dunno how easy or hard it is to solve, but it's worth bringing up in case it is difficult.

Then, something I haven't mentioned is that they may cost a lot, at least the good ones. I know there's Cloudflare's certificates and Let's Encrypt, but they're the bare minimum, bigger sites like Google and Meta have their own proprietary certificates, if not they have a subscription to a ultra-secure certificate for $49.99 a month. Not a huge argument, but I think it's important to note that just like there's Amazon's AWS and DigitalOcean and then there's Nekoweb and Neocities.

Basically, messing with SSL certificates is like messing with linux maybe it's gonna go smooth-sailing or maybe it will crash and burn completely and no matter how hard you try you can't fix it. That doesn't mean everybody should avoid linux just like it doesn't mean everybody should avoid SSL, but it's better not to intentionally inconvenience someone over them not using HTTPS.

[Melooon]

⚑ Moderators Note ⚑

This thread has been locked because the issue it reported was fixed, please move to a new thread if you wish to discuss HTTPS and web protocols.