161
votes
Accepted
Should we display a warning when users include images?
Perhaps a more in your face "Don't do this" would work with the image upload dialog:
Ps this is only a semi-serious suggestion, as I doubt even something this drastic would make any difference if it ...
54
votes
Accepted
Is Stack Overflow secure even when not using HTTPS?
No, there are a number of things about the http connection that are not secure.
Your traffic can be sniffed. This means that someone can see what pages you're visiting. This may or may not be a ...
46
votes
Accepted
Mixed content ad
We have paused this campaign until the advertiser removes or fixes this pixel.
Update: The advertiser has disabled this content and the campaign is live again.
39
votes
Accepted
Why are child meta links flipped after transition to HTTPS?
As Nick Craver explains in his intro blog post from a few years back, meta.*.stackexchange.com is not a valid wildcard certificate. And the upkeep of managing 166 sites, plus 164 child meta sites, all ...
38
votes
HTTPS-only images
status-completedfeature-request Update the Flair HTML snippet
Can you please update the HTML snippet in the Flair section with https in the <img src="http://.
Since copy & paste the snippet ...
38
votes
Accepted
Ad causing mixed content in HTTPS
Reaching out to the client now to get this fixed. The ads have been turned off in the meantime, so you shouldn't see these warnings anymore. As always, appreciate the heads up!
UPDATE
The ads have ...
34
votes
Accepted
Wikipedia links not https, is there a special reason they shouldn't?
No, the HTTPS change only applied to Stack Exchange links.
SE has no idea which sites do and don't support HTTP. It'd be a bad idea to replace every single link in every single answer like that.
If ...
28
votes
Mixed content ad
A twitter discussion led to upgrade-insecure-requests being deployed on all Q&A sites. All requests will automatically get updated to https: if the browser supports this directive, which all ...
25
votes
Should we display a warning when users include images?
As gnat noted, we already had a warning for this - we just broke it a year ago and never noticed.
Adam Lear fixed this 10 days ago, and I'm happy to report that it's once again in the face of any ...
24
votes
HTTPS: It's time
For tracking purposes, so people can see at a quick glance:
Running list of fixed items (please keep reporting!):
Network-wide flair
Site switcher dropdown
Share URLs were http:// (in build 2017.3.6....
23
votes
How to make a working snippet with a library not available in HTTPS?
The best solution is to find an HTTPS based source for the file you desire to use.
Files in GitHub repositories are always available via HTTPS
jsDelivr (instructions for GitHub links)
Example:
...
MakyenMod
- 33.1k
21
votes
adzerk.net causes mixed content error on main site
We're on it!
We see those issues as well, and we're working with our ad server to get this addressed. It will take time, and it will only apply to new tag sponsorships in the future. Updating every ...
19
votes
Accepted
Certificate error when using stackoverflow.com from certain IP addresses
There are multiple possible reasons for your observation, including something funny happening at stackexchange.com. It could also be a name service issue on your end, e.g. some DNS configuration ...
19
votes
Accepted
A required TLS feature is missing. Error code: MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING
We have worked with our CDN provider to roll back a change that was made enforcing OCSP Must-Staple. Firefox should be back in business, sorry for the interruption. To keep up to date follow our ...
17
votes
Accepted
Why does Stack Overflow's help page say the SSL certificate is issued for footballsupport.geniussports.com?
That's just the first domain listed on the certificate. Ours is in the alternative names section, along with a list of other domains using Freshdesk. I believe it's some sort of global "custom domains ...
16
votes
Accepted
The certificate for itr-links.stackoverflow.email has expired
That certificate was being managed by a 3rd party and has now been renewed. When we implemented CAA records we didn't include Amazon which prevented the certificate from automatically renewing.
14
votes
Is Stack Overflow secure even when not using HTTPS?
The best that we know about is that it's still in progress. Here's a similar question on Meta Stack Exchange which has some details.
To answer your specific questions...
Your login is secured ...
11
votes
Should we display a warning when users include images?
I don't think the users1 would read this warning message because they don't read any of the help pages or the help text on the right side.
1The users who are posting in wrong format etc.
If a user ...
9
votes
Bad SSL link on Stack Overflow blog pointing to Stack Overflow Enterprise site
This was an improper link created that should have pointed to the www. website. I pushed an update to fix them, it'll be live in 1 minute and 24 seconds. Now 22. Now 21. Okay hitting submit.
9
votes
Is Stack Overflow secure even when not using HTTPS?
Laurel and Makoto's answers more or less say what I was going to say.
We aren't doing anything special to the inherently not-secure HTTP traffic. However, certain parts of the site are already ...
8
votes
Accepted
Stack Overflow SSL certificate appears invalid to my browser
One reason for this type of problem is that your browser is still using any of the expired certificates, like 'DST Root CA X3' certificate.
So you can do one thing. Just check your certificate (by ...
7
votes
SE Network Login Test Page: "Messaging failed; stackauth.com skipped" - Am I missing something?
This entire test page is... Woefully obsolete. Even if all the tests completed successfully, there's no guarantee you'll be able to log in... And of course, the tests failing indicates nothing, since ...
6
votes
Accepted
Has the community bot changed too much in changing HTTP links to HTTPS?
As mentioned, this only works with questions that aren't deleted because deleted questions simply don't exist as far as the public API is concerned. There's a reason they're called deleted questions ...
5
votes
https://www.stackoverflow.com redirects to insecure http://stackoverflow.com
Can we remove all absolute urls like this one...
<a href="http://stackoverflow.com/questions/..." ...>
And make them protocol relative:
<a href="//stackoverflow.com/questions/..." ...>
...
5
votes
Link to chat from Site Switcher is not HTTPS
This look to be fixed since at least this morning. The links in the Site Switcher are now
<div class="related-links">
<a href="https://stackoverflow.com/help" class="js-gps-track" data-...
5
votes
Accepted
SE Network Login Test Page: "Messaging failed; stackauth.com skipped" - Am I missing something?
This is not a problem on your side, but one in the test-page's code itself.
The code still expects non-secure http:// scheme in multiple places, and thus fails because of the recent https:// upgrade ...
4
votes
Certificate error when using stackoverflow.com from certain IP addresses
stackoverflow.com not being listed in the SAN field is the problem. The real certificate has this value for the field:
Not Critical
DNS Name: *.stackexchange.com
DNS Name: stackoverflow.com
DNS Name: ...
4
votes
Accepted
Talent - Company page shows "Connection is Not Secure" error due to the http:// image
We're been running with HSTS enabled on talent.stackoverflow.com for a little over a year now and have been monitoring Content-Security-Policy reports to make sure this is a rare to non-existent ...
4
votes
HTTPS-only images
Prevent submission of posts that contain HTTP images. […]
[In] remaining posts with HTTP images [that are not HTTPS-accessible] no Markdown will be affected.
Wait, does that mean when I'm trying to ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
ssl × 75bug × 38
support × 16
status-completed × 16
discussion × 14
feature-request × 13
security × 7
hyperlinks × 4
advertising × 4
images × 4
login × 3
firefox × 3
stack-snippets × 2
stack-overflow-for-teams × 2
help-center × 2
email × 2
moderator-election × 2
legacy-stack-overflow-jobs × 2
asking-questions × 1
profile-page × 1
status-bydesign × 1
search × 1
developer-story × 1
chat × 1
new-nav × 1