- Joined
- Apr 26, 2017
- Messages
- 242
- Trophies
- 0
- Location
- The nearest computer
- Website
- termer.net
- XP
- 335
- Country
I just noticed. Why isn't GBAtemp using SSL/HTTPS? That's pretty bad, considering how many users and accounts there are here.
Go to https://gbatemp.net/ and you should have a HTTPS connection. I believe it isn't forced HTTPS since the site would lose a lot of Chinese traffic. Something like that.I just noticed. Why isn't GBAtemp using SSL/HTTPS? That's pretty bad, considering how many users and accounts there are here.
Can't remember the specifics. I just remember from the last HTTPS thread that it was a reason it wasn't forced.Chinese traffic? I'm just curious, is there much legitimate chinese traffic going to the site? And why would forced HTTPS block out chinese connections?
Yes. The SSL on this site is a fairly complex setup and things like that are chosen for a reason, that being those in China (no small amount of the userbase and several flash cart and such team members) and other countries with fun approaches to such things get troubled by it.
Anybody that cares can move to it, also run something like https://www.eff.org/Https-Everywhere
Oh, I just read that they can't enforce censorship easily using encrypted connections. Makes sense. What doesn't made sense is why anyone in China would want to visit this site. The nature of the site is not one that would be condoned by the Chinese gov't (hacking, jailbreaking, pirating).Can't remember the specifics. I just remember from the last HTTPS thread that it was a reason it wasn't forced.
>.htaccessI was there for one of the big discussions on what should go into the .htaccess and the general implementation of SSL. After we sorted out how the various subdomains would play out (historically there were quite a few), someone groaned about having to sort hardlinks in a few places and all the other stuff that comes from a website with as long a history as this (as well as customisation as extensive as it is) then a major component of that discussion was on the demographics/user locations and relative effects of SSL and what might be done.
Such things are what inform the replies to these sorts of questions.
wel i know temp isnt realy a very ambitotions projec but why dont u do geo chek of redirects? set up an 301 from http to https but excludes chinsa.!FAST has already answered, we could enforce HTTPS-only but it would harm traffic coming from China indeed.
they censor a lot of HTTPS-only sites for the reason you can imagine.
and we do have a lot of visitors from China, far from the majority but a significant enough number.
just set the HTTPS version of GBAtemp in your bookmarks and you'll be good. You can even use add-ons that force HTTPS.
wel i know temp isnt realy a very ambitotions projec but why dont u do geo chek of redirects? set up an 301 from http to https but excludes chinsa.!
While that might sort China if you can get the IP ranges sorted (China is not gobbling up IPv4 as much as you might imagine but it is happening in dribs and drabs) there are also a bunch of institutions (normally done such that 443 is slow as sin, enough to get email but wouldn't want to do day to day internet on it), devices and other countries which aspire to similar things.
At that point you end up in the equivalent of
and
But for this
Most work I see done for it is for spam and DDOS protection (the local Indian takeaway you just made a site for is unlikely to be getting traffic from anywhere other than your country, or your country + India/Pakistan/Bangladesh + tourist countries)... and you have dealt with the fun of third party blacklists for the last how many years now?
Not as troubling as losing China (or the technically less capable Chinese) but if business as usual results in no great harm done...
wel i know temp isnt realy a very ambitotions projec but why dont u do geo chek of redirects? set up an 301 from http to https but excludes chinsa.!
Why not do it client side in JavaScript? That way it doesn't take up server resources.there's also the issue of server resources...
adding a geo IP check on every HTTP request could take a toll on the server.
I could add the check only on the / uri (home page) but then if people land on gbatemp through search engine results they wont land on the home page so the HTTPS redirect wont be useful