If anyone wants more info on the Board upgrades we did the other night...

[doconeill]

Well there is a request I have never heard before! I can see the merit in the idea but I'll have to look into what would really be involved. It's a little more complicated because of the load balancer etc but we do it on the static site

I guess I should update the tech blog a bit more often

Hey, I'm always curious about these things...I run systems like these myself (load balancing, replication, etc.)

Load balancing SSL is a big pain, especially with authenticated sessions. If it was only done for the authentication itself it may not be an issue, depending on what information is stored in the cookies.

But, since the cookies bear the authentication info after the initial password exchange, if you don't use SSL from login forward then your account is for the most part just as susceptible if you aren't careful.

 

[k5jm]

I guess I should update the tech blog a bit more often

Could you do a new article on the tag fairy and how a tag fairy is birthed?

 

[WebmasterAlex]

Hey, I'm always curious about these things...I run systems like these myself (load balancing, replication, etc.)

Load balancing SSL is a big pain, especially with authenticated sessions. If it was only done for the authentication itself it may not be an issue, depending on what information is stored in the cookies.

But, since the cookies bear the authentication info after the initial password exchange, if you don't use SSL from login forward then your account is for the most part just as susceptible if you aren't careful.

Our load balancer does "sticky sessions" so it's not insurmountable, I did a bit of reading and the bigger issue is the vbulletin software, I have seen a few statements that it either has to be all http or all https

 

[doconeill]

Our load balancer does "sticky sessions" so it's not insurmountable, I did a bit of reading and the bigger issue is the vbulletin software, I have seen a few statements that it either has to be all http or all https

That's what I figured would be the limitation.

 

[Cyrano]

Great to see the work that you do Alex getting the appreciation it deserves

 

[FireDancer]

Our load balancer does "sticky sessions" so it's not insurmountable, I did a bit of reading and the bigger issue is the vbulletin software, I have seen a few statements that it either has to be all http or all https

Huh, I never thought of the load balancing effecting the use of ssl. I have never had to deal with distributing an ssl session so you have me there.

I could see not having the login page default to ssl and forcing the manual typing of the address with the https:// manually appended. Maybe at that point the ptr record would direct to one of the sites and not the other replications. The software you use to replicate may have a way of forcing traffic to a specific site for ssl. I haven't looked into the logistics of that, it was more just thinking out loud. I imagine it would not be a highly used feature so I don't think the load balancing would be overly effected but working in I.T. for a financial institution makes me think of these things.

I also see the merits of staying https if it were a site where financial information or other high value info was being passed back to the server. I am not concerned with my posts being sniffed as much as just the login credentials. I was thinking of the hotmail model where you can choose to use enhanced security to login and you are then presented with an ssl login page. After loging in the rest of the session is in the clear. This is probably a bad idea for email (and why I use gmail mostly), but would work for a forum. It isn't a big deal for me because I use a unique password for this site for this very reason. I was just throwing it out there as a suggestion.

 

[WebmasterAlex]

Huh, I never thought of the load balancing effecting the use of ssl. I have never had to deal with distributing an ssl session so you have me there.

I could see not having the login page default to ssl and forcing the manual typing of the address with the https:// manually appended. Maybe at that point the ptr record would direct to one of the sites and not the other replications. The software you use to replicate may have a way of forcing traffic to a specific site for ssl. I haven't looked into the logistics of that, it was more just thinking out loud. I imagine it would not be a highly used feature so I don't think the load balancing would be overly effected but working in I.T. for a financial institution makes me think of these things.

I also see the merits of staying https if it were a site where financial information or other high value info was being passed back to the server. I am not concerned with my posts being sniffed as much as just the login credentials. I was thinking of the hotmail model where you can choose to use enhanced security to login and you are then presented with an ssl login page. After loging in the rest of the session is in the clear. This is probably a bad idea for email (and why I use gmail mostly), but would work for a forum. It isn't a big deal for me because I use a unique password for this site for this very reason. I was just throwing it out there as a suggestion.

It wasn't a bad idea at all and it appears that others have tried it with VB, not even load balanced and have had issues, the devil is in the details!