Planned (sort of) downtime

[Martin Blank]

The forums and all other sites hosted on this server will be down, possibly for a few days, sometime in the next three weeks. I'm moving from a CentOS-based VM to one based on Debian 9, which will bring along a slew of features for the back-end including:

• Apache 2.4.25
• PHP 7
• OpenSSL 1.1
• MariaDB 10

All of these have useful roles in protecting the site. I will also be able to tinker with upgrading the structure. Right now, RLF is stuck on an old, MySQL4-based structure which leaves some potential problems and inefficiencies. By bringing it up to date, I hope to be able to avoid some of the errors that have occurred in the last year.

In addition, because Debian moves faster than RHEL/CentOS (boy, a few years ago, I never thought I'd be saying that) and has a means of upgrading between versions (unlike RHEL/CentOS), the ability to keep up with changing technology will improve. With some luck, at some point, some of you will be able to claim to have been RLFers for 20 years.

[Deacon]

*Like*

Those are some substantial upgrades. You’re aware more than most the challenges that come along with keeping systems both secure and functional.

[Martin Blank]

Sorry about the extended downtime. Non-RLF real life got in the way. This should be stable, but I don't entirely trust the other server (which is still up) to try to steal back the IP addresses.

That said, all of the above is still relevant, plus two other changes that will mostly be of interest to the most technical of people:

• All database tables have been altered to InnoDB. This gives some flexibility and stability going forward.
• HTTP/2 is now enabled. Using any modern browser (Chrome, Firefox, Edge, maybe Safari), you should now be connecting over the newer protocol.
• Some further behind-the-scenes security improvements, including new security headers in the HTTP Response, sufficient to get an A on SecurityHeaders.io. The only major one missing now is Content-Security-Policy, and that should be coming along soonish.
• Further tightening of the crypto policy. Some older browsers and mobile devices may have difficulty connecting, but anything that supports TLSv1.2 should work fine. It's enough to get an A+ at SSLLabs

Of course, the IPv6 functionality is still there for those who have access to it. I've also been able to tighten up some server-side settings now that I'm no longer using Interworx.

If you run into any issues, please let me know. I'll get to them as soon as I can.

[Rorschach]

I am both grateful and baffled that you keep the forums ticking along, but never take it for granted since I get even an inkling of what else you have on your plate.
Thank-you.

[Martin Blank]

Part of it is nostalgia, part of it is duty, and part of it is using you all as experiments in my attempts to create a usable but relatively secure platform, knowledge that I then use in my day job to profit off of you peons enhance the overall security of the world.

[Deacon]

I miss when Chrome would make info like SSL/TLS version and cert info readily available.

[raptor9k]

Yeah, I don't really get why you can't view it from the green lock anymore. The security tab in dev tools is great but most users don't know to look there.

[Martin Blank]

You can go to chrome://flags, look for Show Certificate Link, click Enable, and relaunch the browser. After that, you'll get an option to show the certificate (look for Valid or Invalid under Certificate at the top of the menu when you click the lock icon).

[NorthernComfort]

Or uninstall Chrome and just use extra-verbose curl for everything, so you may read -- nay, so you may CHERISH -- the certificate info with every request.

[Deacon]

Haha, NC, that may be a bit much for some users. Not me, though, of course...

>.>
<.<

MB, thanks for that little tidbit. I don't know why they hid it in the first place, but they also hid the encryption details (protocol, key exchange, cipher). CTLR+SHIFT+I is fine, but why hide it?

[Metzgirl]

I realize now, upon reading this post I kind of understand, that most of my inherited nerdiness probably started in this forum.

[Deacon]

We do what we can