We're working on making browsing all sites via SSL available to members. We need some help spotting bugs.
posted by pb to Feature Requests at 9:54 AM (115 comments total)
20 users marked this as a favorite
This new feature will add a checkbox to site preferences to "Use SSL everywhere?". Once checked and saved, you'll browse all metafilter.com sites via SSL. (Keep in mind you'll need to do this for each browser you use
.) SSL is a security protocol that encrypts the traffic between your browser and the MetaFilter servers. For example, SSL can help keep people from eavesdropping on your MetaFilter traffic if you're on a public wifi network.
We've been testing secure browsing internally for a while and it's working fairly well. There are a few caveats:
- Many 3rd party systems we use on the site do not offer a secure (or completely secure) version of their service. For example, the only profile widget that works with a secure connection is the new Twitter widget. So switching to SSL Everywhere means you won't see the other profile widgets on profile pages.
- The inline YouTube player loads securely but streams insecure content once you click play.
- Many Greasemonkey scripts and MetaFilter-specific browser add-ons will not work with SSL Everywhere. Many simply aren't expecting the new protocol. If you enable SSL Everywhere, expect any browser add-ons you're using to break. (Potentially script authors will be able to modify their scripts to work with this feature.)
- We still have many non-secure page redirects happening. So if you click on an internal MetaFilter link such as a username, it might be an insecure request that is then routed to the secure version of the page. That means your MetaFilter cookies could be intercepted on a public network. We're working on changing these links across the site.
SSL Everywhere is close to being ready for everyone, but we need a few people who don't mind running into some problems to try it out and report bugs back to us. We can't fix 3rd party systems or browser add-ons, but we'll fix up what we can control. Please note problems here and include your browser/OS combination. If you need to disable the test and can't get to the Preferences page to reset things, clear your MetaFilter cookies and log in again. Thanks for your help.
As far as future plans go, once we get the bugs worked out of this feature it will be available for members and will be off by default like it is now. We consider it a benefit of membership and something you can enable if you want to use it.