1

I just noticed something weird - my Firefox warned me about usage of non-SSL resources on this question:

Why do some websites enforce lack of SSL?

while not on this one:

Why is it possible to sniff an HTTPS / SSL request?

I started digging and I realized that my browser is making a request to imgur.com over HTTP to pull Matthew Elvey's avatar. This leads me to two questions:

  1. Why was I making any requests to imgur whatsoever just while watching someone's avatar?
  2. If imgur was in any way related to stackexchange, why wasn't HTTPS used? (imgur supports it)
5
  • 5
    SSL is not supported yet, if you force any SE site to use HTTPS it will break some stuff. Mar 13 '14 at 15:17
  • Ah, I see, I guess that it answers my question. I used "HTTPS finder" Firefox extension to force it.
    – d33tah
    Mar 13 '14 at 15:26
  • @MadScientist this is wrong, SE has rolled out SSL support a while ago. I think with the exception of meta.* sites, though.
    – AviD Mod
    Mar 14 '14 at 8:39
  • 1
    @AviD They have proper certificates for the main sites now, but there is still a lot of stuff that doesn't work like e.g. MathJax. Forcing SSL is not supported by SE. Mar 14 '14 at 8:40
  • Yeah, there some things that are not supported yet. I guess imgur.com is one of them.
    – AviD Mod
    Mar 14 '14 at 8:41
3

You can force HTTPS connections to both Imgur and StackOverflow by using the latest build of the HTTPS Everywhere extension for Chrome or Firefox, but it's likely that some things will break. Build instructions are at https://github.com/efforg/https-everywhere.

Imgur contacted me to note that they have full SSL support now [1], so we recently added a rule for them. Stack Exchange is still a work in progress, but I'm trying to add exclusions for all the mixed content cases that come up in the meantime.

[1] https://github.com/EFForg/https-everywhere/pull/88

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .