I’ve not read this yet, just passing it along, as it looks really interesting.
I’m not affiliated in any way with this.
ETA: If anyone has read it / bought a copy, a review would be very appreciated.
I’ve not read this yet, just passing it along, as it looks really interesting.
I’m not affiliated in any way with this.
ETA: If anyone has read it / bought a copy, a review would be very appreciated.
Hopefully the author explains how to use SSL/TLS since their site doesn’t :/
They do, via Traefik. Chapter 8.
Maybe they decided there was nothing that requires an SSL/TLS certificate on this particular site? (They accept payments elsewhere).
It’s because you linked to the site using http://. This is something the site should account for, but doesn’t.
How do you know that if you’ve never read it?
Because I clicked the link and read the link at the top which says “Code”. The book’s contents are open source. :)
Though I think everyone who can afford to and wants a copy should consider buying one. As an author myself, I know this author would prefer that option, but they’re being very cool by sharing the contents online too.
https://github.com/meonkeys/shb/blob/main/book/steadfast.asciidoc
The site does use https for me… it instantly redirects from http to https
Your browser is redirecting, the site is not.
That’s possible, I’m using Firefox, is that something firefox would do?
Yes, there is/was a setting for that, should be on by default.
Sounds like the robot guy doesn’t use https only mode
I might have missed it, but it doesn’t look like their site accepts payment data, or has a login of any kind.
Why would the lack of SSL concern you?
The site is encrypted but you can also access the site over http. The author hasn’t configured any kind of HTTPS upgrade. This is an easily correctable oversight that a self proclaimed “self hosting expert” should have accounted for.
They should just block port 80
Or not have the website listen on port 80, or redirect connections from http to https on connect. Lots of very simple ways to correct this problem.
Why wouldn’t that concern you? That means it is totally plain text with zero verification of incoming data or encryption. It is really easy to tamper with http traffic.
The site links to a site that accepts payment data. So because the author’s site is http, a MITM attacker could change the payment links from lulu.com to site-that-actually-steals-your-credit-card.com.
That’s one huge thing https provides over http… assurance of unadulterated content, including links to sites that actually deal in sensitive data.
Because it means my traffic to that site is in the clear. And while we’re not transacting anything sensitive necessarily. It’s still best practice to limit sniffing.
Automatically swapping to https should be default behavior for every website.