Green Building Forum - Forum problems?

Forum problems?

Nick Parsons — Wed, 18 Oct 2023 18:39:48 +0100

I am really struggling with GBF today. I have taken to not staying signed in, as my computer keeps telling me my connection is 'insecure'. However signing in has been straightforward. Today it has not been. I sign in, go to start a topic and (a) it tells me the info is insecure and (b) it then appears to sign me out. I have had to try at least twice for each post today. Has anyone else had these issues?

Thanks. Nick

P.S: I got this:

"The information youâ€™re about to submit is not secure
Because this form is being submitted using a connection thatâ€™s not secure, your information will be visible to others.' and it would not send. Trying again.

Forum problems?

WillInAberdeen — Wed, 18 Oct 2023 20:00:05 +0100

I get the same. It's because the webpage has a 'form' to collect data such as your username and password. Which it sends off to
http://www.greenbuildingforum.co.uk/newforum/post.php

That is a 'http' address not a 'https' secure address (which they should be these days), so the browser has started flagging that up as a security problem.

The best solution would be for someone to update all the links hidden in the workings of GBF, so they all go to https not http.

Forum problems?

WillInAberdeen — Thu, 19 Oct 2023 10:32:21 +0100

I can't sign in at all today, the browser won't send my password to the unsecured 'http' address in the GBF web page. I'm using the ad hoc 'add a comment' option.

Forum problems?

djh — Thu, 19 Oct 2023 13:25:42 +0100

As the customer support muppets regularly say: "Can you try a different browser?" Usually they want me to use a more modern one, and preferably Chrome, but here it might be worth trying a different and perhaps older one.

Neither of you have told us which browser you are using, nor its version, and when it was last updated, nor the operating system you are running it on, which might be useful. I suspect in this case that we might discover you are both using a browser that has been updated recently and has now set more secure defaults. Usually it's the web site that has updated and only now supports a newer browser. If we knew which it was, we could probably look and see how to disable its new enthusiasm.

Forum problems?

WillInAberdeen — Thu, 19 Oct 2023 13:55:16 +0100

Chrome 117.0.5938.156
Updated today
Android 10
I'm not installing a new browser, even to stay on GBF!

If you look at the html for this page, the offending line is:

Add your comments

Forum problems?

bhommels — Thu, 19 Oct 2023 13:58:31 +0100

I'm battling same problem, and thanks to WillInAberdeen for making a sensible sounding diagnosis.

I hope that the advice is not going to be to deliberately run an outdated browser with known security holes to access GBF?

@djh: it happens on firefox 102.12.0esr on Linux 3.10.0-1160.92.1.e17.x86_64 as well as on Chrome 118.0.5993.70 (Official Build) (arm64) running on a Macbook Air running Mac OS X Ventura 13.5.2 (22G91).

Forum problems?

WillInAberdeen — Thu, 19 Oct 2023 14:02:26 +0100

If I were able to edit comments, I would add that I don't understand why you the ad hoc 'add your comments' form still works (although with lots of security warnings to click through) but the 'login' form does not.

Forum problems?

WillInAberdeen — Thu, 19 Oct 2023 14:21:44 +0100

If I were able to edit comments, I would also ask DJH or anyone else who isn't having problems, to tell us what browser/version/os they are using.

I would ask if they had logged out and back in again today successfully, but warn that it might not work!

Forum problems?

Jeff B — Thu, 19 Oct 2023 14:55:15 +0100

Funnily enough I have just logged in successfully and started a new thread. I use Firefox. (Version 118.0.2) 32 bit.

Forum problems?

revor — Thu, 19 Oct 2023 15:48:58 +0100

I have had no issues. (Famous last words) Windows 10 and MS edge.

Forum problems?

djh — Thu, 19 Oct 2023 18:00:27 +0100

Well it still works with FF 115.3.1esr (64-bit) (the current ESR version, AIUI. 102 is obsolete) and with FF 118 so it's not a question of an old unpatched version. I expect it's a question of setting the right option, whatever that is. Apple products are different because the guts of the browser is Apple-specific under the hood.

There's no way I will ever use Google's Chrome.

Forum problems?

WillInAberdeen — Thu, 19 Oct 2023 20:25:52 +0100

Well some more weirdness - I now signed in the normal way, and was rejected when I deliberately used an incorrect password.. That doesn't fit what I said about passwords only being sent to https URLs. If I try an edit or posting, it signs me out.

63% of web browsing is done with chrome, so unfortunately I don't see much future for a forum that doesn't support it, or needs its default security measures to be turned off. Due respect to firefox (3%), and RIP to Netscape Navigator!

Forum problems?

djh — Thu, 19 Oct 2023 20:39:50 +0100

I'm not sure it's weird to be rejected when you use an incorrect password? Passwords are sent whatever transport you use; the issue is whether they are encrypted (https) or not (http).

Personally I don't care who sees my password, since it's unique to this site and we luckily don't seem to get any impersonation attempts (famous last words!). If any site says it requires Chrome, I simply don't use that site.

Having said all that it would make sense for this site to convert to https.

Forum problems?

WillInAberdeen — Thu, 19 Oct 2023 21:02:25 +0100

I had understood that chrome will no longer allow web forms to submit sensitive data (types such as passwords or credit card numbers) to non-https URLs.

Weirdly it seems that the non-https GBF address where passwords are sent for checking (http://www.greenbuildingforum.co.uk/newforum/people.php) was able to receive my incorrect password and reject it. So maybe something else is the problem..

Forum problems?

cjard — Fri, 20 Oct 2023 16:10:25 +0100

"The best solution would be for someone to update"

...the entire forum software to one that is under active development

Forum problems?

wookey — Fri, 20 Oct 2023 19:46:27 +0100

I find the modern obsession with https everywhere rather frustrating. It does make sense for some things (like login forms), but a lot of the time it's pointless. E.g. it's extremely irritating to be told I can't download a PDF because it's 'insecure'. It's just a file, already public on the internet. I'd like a copy please, which doesn't need to be crypted and then decrypted just for transport. The risks of someone MITMing the transport and changing the file are low, and I'm just going to read it so if it said something slightly different (about retrofit) it wouldn't matter much, and if it said something completely different I'd notice (or the file would just be corrupt).

Firefox-esr 115.3.0esr is still working fine on the forum for both login and display, despite it bitching more than I would like about transport protocols sometimes.

The sign-in post link probably does need to change soon otherwise this resource will become unusable without digging out an older browser. (At least we can guarantee tat it will work in quite an old browser :-)
Given the complete lack of interest so far in updating it after previous threads, this may prove fatal. Has anyone managed to get a response from Keith? The site already has https working already so this is a trivial fix.

Forum problems?

WillInAberdeen — Fri, 20 Oct 2023 22:55:29 +0100

An experiment - I copied the source html for the GBF login page, pasted it into my own local file, edited the 'http' link to 'https', opened in chrome.

All problems were fixed, no errors to click through, logs in every time. So seems that was indeed the source of the problem.

The 'edit comments' and 'post a reply' pages are more complicated to make standalone copies work, and the website http copies log me out. So this doesn't work as a long term solution, even if I were willing to put up with it. IE it's looking like I might be about to have more time in my day, without GBF.

Many android users have our browser automatically apply updates to the latest version, after which there's no choice to go back to some earlier version, even if we were willing to (I'm not).

Forum problems?

djh — Sat, 21 Oct 2023 15:48:48 +0100

Posted By: WillInAberdeenIE it's looking like I might be about to have more time in my day, without GBF.

I'd be sorry to see you go. We don't always see things the same way, but I can generally appreciate your point of view, and it's usually well researched.

Many android users have our browser automatically apply updates to the latest version, after which there's no choice to go back to some earlier version, even if we were willing to (I'm not).

For me, it feels more important to have some control over what I run, but I accept there are other views. And android suffers from the same problem as chrome - too much google. I'd rather put my trust in apple instead.

Forum problems?

Peter_in_Hungary — Sat, 21 Oct 2023 17:11:52 +0100

Posted By: djh
Posted By: WillInAberdeenIE it's looking like I might be about to have more time in my day, without GBF.
I'd be sorry to see you go. We don't always see things the same way, but I can generally appreciate your point of view, and it's usually well researched.

+1

P:S: I am on firefox 115.3.1esr (64-bit) and I have no problems.

Forum problems?

Nick Parsons — Sat, 21 Oct 2023 17:15:11 +0100

Yes, Will-in-somewhere (!), please stay. Sending this (a) for that reason and (b) to see if I get locked out!!

Forum problems?

Nick Parsons — Sat, 21 Oct 2023 17:17:14 +0100

As before - locked out and allegedly signed out (so the red message says) but then I could just press 'send' again and it gets through - without having to sign in again. Gosh, this is tough for a Bear of Little Brain!

Forum problems?

GarethC — Sat, 21 Oct 2023 18:45:30 +0100

Why doesn't the forum owner update the software? Is it no longer updated such that a port to another platform would be required?

Forum problems?

Peter_in_Hungary — Sat, 21 Oct 2023 20:54:02 +0100

Posted By: GarethCWhy doesn't the forum owner update the software?

Maybe financial implication and / or lack of interest

Forum problems?

GarethC — Sat, 21 Oct 2023 22:00:07 +0100

Just checking forum plugins for wordpress. Doesn't look expensive... Could maybe port to my site if current host doesn't have time if that's possible in extremis. Don't want this community to disintegrate due to outdated platform.

Forum problems?

wookey — Sun, 22 Oct 2023 00:54:46 +0100

Posted By: WillInAberdeen
Many android users have our browser automatically apply updates to the latest version, after which there's no choice to go back to some earlier version, even if we were willing to (I'm not).

You can have more than one browser installed. There are loads of them. It's currently working fine on Fennec for example. Tiresome having to run another browser for the forum, but probably less tiresome than arguing with software that bleats at you and logs you out and generally makes life difficult.

Does something equivalent to greasemonkey still exist for browsers? That would let us edit the offending URL clientside so we could all just install said plugin+script and we'd all have a workaround. I recall looking for greasemonkey a year or two ago (for some similar task) and finding that it was no more.

Forum problems?

djh — Sun, 22 Oct 2023 10:58:48 +0100

https://addons.mozilla.org/en-GB/firefox/addon/greasemonkey/

Forum problems?

vord — Sun, 22 Oct 2023 18:30:57 +0100

It seems that http: has been added to the post reply destination address. Internal links don't need the full site name and whatever http protocol that happens to be fashionable. To be on the safe side a site wide find and replace http to https would probably fix it.

Also a server side redirect from http to https would be helpful to those with older bookmarks.

Forum problems?

borpin — Sun, 22 Oct 2023 22:42:13 +0100

I think the forum is effectively unsupported. The software in use has no easy migration path and the cost of custom migration is prohibitive. There was a suggestion it would migrate several years ago, but that never happened

At some point all will be lost as browsers are mandating HTTPS (they now often fail on internal http connections - I have a NAS that is unreachable via the browser which is daft!). It is the effect of dumbing down.

If these was to be a new forum, then the Discourse software (seen on the likes of Node-RED and HomeAssistant) is probably the best, but setting up and managing it is no small task.

Most of the 'free' systems such as Google Groups and Yahoo are slowly disappearing.

[edit]
Yes new forum was mooted in 2014/15. Search on 'forum' as a subject term for more info.

Forum problems?

GarethC — Mon, 23 Oct 2023 19:31:20 +0100

Can't someone here help us upgrade the forum version? https://open.vanillaforums.com/

Or this to migrate to discourse? https://meta.discourse.org/t/migrate-a-vanilla-forum-to-discourse/27273

I know bugger all about all this so realise probably not...

Forum problems?

djh — Mon, 23 Oct 2023 20:34:59 +0100

Several of us have offered to help over the years but Keith has never taken anybody up on it AFAIK.

Until the latest brouhaha about certain browsers knowing better than their users and forbidding connections, it hasn't really been a 'life or death' issue in any sense. It wouldn't be now except that some/many? people aren't willing to be flexible enough to use a browser that offers enough options (or perhaps to configure whatever browser they are using for this forum). I am, but I'm not willing to do other things like create a google account or a facebook account etc so I can understand their point to some extent.