SERVER SSL Upgrade - Page 1
Forum section: electronics / general

author: EEVblog
author_rank: Unknown
timestamp: March 31, 2017, 05:12:33 am
content: gnif will be installing SSL support on the server shortly.This is a thread to discuss issues and rejoice for those who have been asking for it.

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 05:32:36 am
content: Note: This does not mean the website will enforce SSL usage, there will still be things to verify/check update, etc. before we can do this.

author: amspire
author_rank: Super Contributor
timestamp: March 31, 2017, 05:45:33 am
content: Enabling SSL will result in many threads being marked on the browsers as insecure. To get the proper green SSL icon in your address bar, everything on the page has to be SSL. If there are links to non-ssl images, the page does not get the green SSL icon, and if you left click on the greyed icon, it will say "This connection is not protected".If you look into the details, it will say something like "This site has unprotected content".If there is a link to an image on a remote site, the address bar SSL icon will be green as long as the remote image address is also SSL.Probably impossible to get around this with old threads, and for new threads, to get the green SSL icon, you would have to insist on https:// links only.Edit: many users have uploaded images, and then posted the image address into their post to get the full sized image. All of these addresses start with "http://www.eevblog.com/....", so they will force to SSL icon to grey. It may be possible to write a script to find these links, along with links to other posts, and turn them into relative addresses to make them SSL compatible.

author: EEVblog
author_rank: Unknown
timestamp: March 31, 2017, 06:07:16 am
content: Quote from: amspire on March 31, 2017, 05:45:33 amIn that case it's impossible to police, nor should we even try.It's a public forum, the content doesn't have to be protected, just that some poeple are paranoid about their login details etc.

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 06:37:01 am
content: Quote from: amspire on March 31, 2017, 05:45:33 amThis is not entirely correct, links to other sites do not have to be https, only embedded content, such as links to youtube, which is handled by the forum dynamically so this is no issue. As for manual entries in the database we have four options:1) Search and replace across the database to replace the links we can.2) Use mod_pagespeed to rewrite the links3) Tell cloudflare to rewrite the links.4) Serve the header 'Uprade-Insecure-Requests' which makes the client browser rewrite them to https.Normally a combination of 1 & 4 are the best.We have had many ways to deal with this over the years, it is not a big issue. Also not many people know this, but a valid url can be "://somesite.com" (note the lack of http/https) and the browser will auto-select the correct protocol based on how the page was loaded.

author: amspire
author_rank: Super Contributor
timestamp: March 31, 2017, 06:47:57 am
content: Quote from: gnif on March 31, 2017, 06:37:01 amI was referring in particular to embedded images. Many images in the threads are hosted externally and many of these links will be http.Links to other sites can be http, but the problem there is as long as you do not enforce SSL for the site, then even if you deliberately go to the forum using https, click on one old link to another thread and you are back to http.Making the forum https-only as soon as possible will cure all the internal link problems. It will probably even cure the problem of the embedded http image links to images uploaded to the forum.

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 06:49:58 am
content: Again, serving the header 'Upgrade-Insecure-Requests' will make your browser redirect an insecure URL to https. We can also server side redirect traffic to https for when this occurs and the client's browser doesn't support the upgrade header (which all do these days)

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 08:04:29 am
content: We are aware of a broken URL issue (emoticons in posts), this is due to caching at CloudFlare, this will be resolved soon.

author: grumpydoc
author_rank: Super Contributor
timestamp: March 31, 2017, 08:14:21 am
content: Quote from: gnif on March 31, 2017, 06:49:58 amThat assumes that you can replace "http://" with "https://" in a URL and get the same content.On the server where I have installed SSL (with a letsencrypt certifiace) http and https yield completely different sites (in fact http:// is internal only and blocked at the firewall so it won't get you anything).On the server I use to host my embedded images for forum posts that I have made I only have http configured so https will not get you anything.I am sure that there will be a lot of other embedded image links where just switching to https will not work - I know that it will mean browser warnings but I would leave embedded URLs as they are.

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 08:17:52 am
content: Quote from: grumpydoc on March 31, 2017, 08:14:21 amURLs only get upgraded if the host the url is served from specifies the "Content-Security-Policy: upgrade-insecure-requests" header, which I assume you are not.Blocking http at the firewall is a bad idea unless you have submitted your site to the HSTS lists for chome/edge/ff, etc., and even then you should not rely on it, a simple 301 redirect to https is the way to go if you want to ensure that people can get to your website.Edit: And yes, there will be use cases where there is no option but to server the embedded content via HTTP instead of HTTPS, so yeah, we can't mess with this. It also prevents us from using HSTS, but because of the nature of this website, we don't care for it anyway.

author: Ian.M
author_rank: Super Contributor
timestamp: March 31, 2017, 08:25:21 am
content: Please note Google Translate does *NOT* work on https pages. Forcing https, other than as a per-user preference will seriously disadvantage any users who use it due to poor comprehension of English.

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 08:27:26 am
content: Quote from: Ian.M on March 31, 2017, 08:25:21 amWorks just fine for me:https://translate.google.com.au/translate?sl=auto&tl=es&js=y&prev=_t&hl=en&ie=UTF-8&u=https%3A%2F%2Fhostfission.com&edit-text=

author: Ian.M
author_rank: Super Contributor
timestamp: March 31, 2017, 08:34:03 am
content: Well that seems to be new. I've frequently run into problems trying to translate secure pages on German or Russian technical forums when trying to find data for old obscure parts.

author: Muttley Snickers
author_rank: Unknown
timestamp: March 31, 2017, 08:50:30 am
content: Could somebody take a look at the jump to or hyper jump links in all of the boards just to verify whether the problem is my end as they do not display a drop down list anymore, I do remember the Metrology one being busted previously anyway but now it's all the rest as well, also just noticed that I cannot scroll with my mouse wheel on this reply page, that's a new issue and the problem could be my end as I haven't been using this PC much of late.Many Thanks.

author: EEVblog
author_rank: Unknown
timestamp: March 31, 2017, 08:51:44 am
content: http is now redirecting me to https and the Chrome info box shows

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 08:52:07 am
content: There are a few issues caused by the SSL setup, please be patient, I will update when things are done and working.

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 08:52:42 am
content: Quote from: EEVblog on March 31, 2017, 08:51:44 amThis is due to mixed content on the page, it is expected.

author: grumpydoc
author_rank: Super Contributor
timestamp: March 31, 2017, 08:54:06 am
content: Quote from: gnif on March 31, 2017, 08:17:52 amSurely putting upgrade-insecure-requests on eevblog pages would make the browser try to fetch any embedded link over https, not http - nothing to do with my server.I need to read the documentation; I only had a glance but it seems to contradict itself on whether 3rd party links are affected.PS: posting is getting a warning about an insecure channel.

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 08:56:01 am
content: Quote from: grumpydoc on March 31, 2017, 08:54:06 amPlease see:https://www.w3.org/TR/upgrade-insecure-requests/#example-navigationQuote

author: Muttley Snickers
author_rank: Unknown
timestamp: March 31, 2017, 08:58:47 am
content: Thanking is also up the creek.

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 09:01:02 am
content: There will be many issues, most known, I am working thought them, but constantly having to reply here to state it is a WIP is slowing things down, not to say I do not appreciate the help.

author: grumpydoc
author_rank: Super Contributor
timestamp: March 31, 2017, 09:01:23 am
content: Quote from: gnif on March 31, 2017, 08:56:01 amYes, but I'm struggling to see any difference between example 2 (which you quote) and example 1 which saysQuotePS: "Insert quote" is broken.

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 09:04:00 am
content: Quote from: grumpydoc on March 31, 2017, 09:01:23 amThe difference is links vs embedded resources, I had missed this and will need to be addressed.QuoteYeah, tons is broken, please wait.

author: grumpydoc
author_rank: Super Contributor
timestamp: March 31, 2017, 09:10:38 am
content: Quote from: gnif on March 31, 2017, 09:04:00 amDuh, I really should not have needed that pointing out but obvious now so thanks.So a bit further down it confirms that this would be a problem for embedded imagesQuote

author: FrankBuss
author_rank: Unknown
timestamp: March 31, 2017, 09:16:59 am
content: https://www.eevblog.com/forum/doesn't redirect to a SSL connection, as e.g.http://www.google.comdoes.

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 09:34:47 am
content: Quote from: FrankBuss on March 31, 2017, 09:16:59 amCorrect, please hold off on testing/reports until I state things are ready.

author: hammy
author_rank: Unknown
timestamp: March 31, 2017, 09:40:37 am
content: @gnif & Dave: Thank you!

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 10:07:30 am
content: For those wondering what the issue is, SMF is correctly generating the URLs for things with http or https as required, but there is some post filtering going on somewhere that is rewriting the https links to http, I am tracing the cause now.Edit:It appears the cause is 'Pretty URLs'Edit 2:Confirmed, Pretty URLs is caching the URL rewrites, but is not caching the scheme, so its randomizing the URL schemes based on who loaded it first, either via HTTP or HTTPS

author: EEVblog
author_rank: Unknown
timestamp: March 31, 2017, 10:52:54 am
content: Quote from: gnif on March 31, 2017, 10:07:30 amIs that fixable?Pretty URL's is an important plugin.

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 10:53:58 am
content: Yes, I am digging through it now, I have already patched several locations that were a problem, should get to the bottom of it soon.

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 11:02:57 am
content: I had to:1) apply a patch to make it cache the replaced URLs based on the presence of SSL2) Discover it doesn't use the forums base url, but its own separate setting which it stupidly doesn't expose in the admin area.Code:update smf_settings set value = '//www.eevblog.com/forum' where variable = 'pretty_root_url';Still yet to go through and check everything over before I give the 'Its working, look for bugs' update

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 11:11:51 am
content: Ok, seems good across the board to me, both SSL and non SSL.Sorry If I come across a bit rash with my replies to reports, I just stress out a bit when things don't go as planned, I certainly do appreciate the testing and feedback provided by the community.Edit: Also, if Dave ever decides to turn off CloudFlare the website will continue to just work, we have valid end to end encryption now.Edit2: We are not serving the upgrade-insecure header to keep embedded off site images working, but we are complying with client's asking to upgrade from insecure, this will keep us completely backwards compatible.Edit3: Seems the simley faces are always being served from http regardless, I will look into this tomorrow, I have had enough for tonight

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 31, 2017, 11:32:31 am
content: I spotted what I think is a side effect of the changes: When reading the unread or unreadreplies link when you click on a post and then use the back button it reloads the list and the post you just read is gone. This is a bit confusing because it makes tracking where you are more difficult.(I don't read all posts on the unread page, just the ones that interest me, and then simply use the back button on the mouse to go back to the list. When everything was still http: it showed me the same list everytime.)

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 11:35:28 am
content: Quote from: PA0PBZ on March 31, 2017, 11:32:31 amMy bet is you loaded that page via HTTP and when you hit back, it is going back to the HTTP page, which is then being upgraded to HTTPS. Did you perhaps go to the unread page via a bookmark? Btw I can not replicate the behavior you mention.

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 31, 2017, 12:04:51 pm
content: Nope, HTTPS all the way. It's only IE, Chrome and Firefox are fine.(Yes I have to use IE for some undisclosed reason, but I can use chrome for the forum)

author: rrinker
author_rank: Super Contributor
timestamp: March 31, 2017, 01:55:05 pm
content: Maybe I'm not interpreting what you posted correctly, but it sounds like what you are doing is similar to how I read the forum. Click on a sections, read the messages that interest you, then back out and go on to the next section. However, I never use back to get all the way out, I click in the nav tree just above the messages, because as long as I've been here, no matter what browser I use, if I just use the back button, it still shows flags the section as having new posts. If I actually use the tree to select the top level, or even the high level category, then the section I just was in will show as having no new messages (unless someone actually snuck in and posted). That happens for me with Chrome, IE, Edge, or Safari. Sometimes I forget and use the back button (easy when there's a back button right on the mouse) but in that case I can either revisit the section and go back via the tree or refresh the page. This does not appear to have changed with HTTPS.

author: PA0PBZ
author_rank: Super Contributor
timestamp: March 31, 2017, 02:12:21 pm
content: I use the 'show unread posts since last visit' on the top of the page, that way I don't have to navigate the sections. If I click a post in that list and then go back with the (mouse) back button the post I just clicked is gone from the list, as if the list was generated again. This only in IE as I mentioned.

author: rrinker
author_rank: Super Contributor
timestamp: March 31, 2017, 02:37:57 pm
content: That sort of sounds like it works as intended, but ONLY in IE - after all, if you've read the post, it no longer is unread and shouldn't appear on the list.

author: Monkeh
author_rank: Super Contributor
timestamp: March 31, 2017, 08:07:40 pm
content: Paging Dr. gnif, notification links are missing their protocol:https://www.eevblog.com/forum/blog/notification-precated/

author: gnif
author_rank: Unknown
timestamp: March 31, 2017, 08:45:09 pm
content: Quote from: Monkeh on March 31, 2017, 08:07:40 pmThis is a known issue, I do not have time at current to look for a solution, it is a minor breakage and not a high priority at the moment.

author: texaspyro
author_rank: Super Contributor
timestamp: March 31, 2017, 11:27:01 pm
content: Quote from: gnif on March 31, 2017, 08:45:09 pmA lot of email systems don't recognize the link as a link without the http: and you have to cut it from the email, paste it into the browser address bar, then edit it to include the http: A royal pain if you have a lot of notifications to check out.Good luck on the https upgrade... I've been down that rabbit hole before and it's no fun to get all the issues sorted out.

author: bitseeker
author_rank: Super Contributor
timestamp: April 01, 2017, 02:52:57 am
content: Thanks for the SSL/TLS upgrade. If legislation in the US passes to allow ISPs to profit from our browsing activity, inject ads (or who knows what else) onto other sites' pages, etc., having end-to-end encryption will help.

author: magetoo
author_rank: Frequent Contributor
timestamp: April 01, 2017, 06:14:12 pm
content: Is the long-term plan to turn off HTTP and go HTTPS-only? Asking because I'm noticing that everything except the initial page load (stylesheets, images) gets turned into HTTPS even when accessing the forum via HTTP. Except for the emoticons.

author: gnif
author_rank: Unknown
timestamp: April 01, 2017, 06:15:03 pm
content: Quote from: magetoo on April 01, 2017, 06:14:12 pmNo, there is some inconsistency at the moment, but the plan is to fully support both.

author: magetoo
author_rank: Frequent Contributor
timestamp: April 01, 2017, 06:27:57 pm
content: Quote from: gnif on April 01, 2017, 06:15:03 pmGood to know. Some things seemed wonky (using HTTP going through a Squid proxy) but I'll hold off on complaining.

author: gnif
author_rank: Unknown
timestamp: April 03, 2017, 11:34:55 am
content: In what time I could find the last few days I threw together a mod for SMF that allows inserting post filter hooks, the website will now generate the correct URLs depending on if you visit using http or https.The filter is a search and replace based on the forum URL, for example, if I post this:https://www.eevblog.com/forumIt will be automatically changed to http or https depending on how you load this page, this should keep everyone happy. This filter only applies to URLs starting with "www.eevblog.com/forum", everything else is ignored. If this causes any problems please post them here.

author: Ian.M
author_rank: Super Contributor
timestamp: April 03, 2017, 11:49:30 am
content: Many thanks. I've just commented out the link rewriter in my Greasemokey script and I'll see how it goes.Would it be possible to post a list of SSL/TLS protocols and encryption methods the server now accepts, so those of us with legacy browsers can check compatibility against possible browser upgrades *BEFORE* installing them?

author: gnif
author_rank: Unknown
timestamp: April 03, 2017, 01:03:42 pm
content: Quote from: wilfred on April 03, 2017, 12:52:11 pmThey are not local customisations, I have written a proper package that integrates/installs/uninstalls and is tracked up the updater, there should be no issues.That said, since it seems to be working I am going to disable the redirect if the browser states to upgrade requests, that way people can decide if they do or don't want SSL.

author: gnif
author_rank: Unknown
timestamp: April 03, 2017, 07:38:43 pm
content: No complaints so far, everything seems good.I made a small change so that the login URL is always https (including the one on the top banner), but it will still work with http if you really must use http, just drop off the 's' in the url.Edit:Just picked up a small issue, when posting it posts to HTTPS, but redirects you back to HTTP, I will investigate this later if I can.

author: RayRay
author_rank: Frequent Contributor
timestamp: April 03, 2017, 07:42:09 pm
content: But why is SSL not used by default? When loading the forum, it just loads it in plain-text (without automatically redirecting to https)

author: gnif
author_rank: Unknown
timestamp: April 03, 2017, 07:43:06 pm
content: Quote from: RayRay on April 03, 2017, 07:42:09 pmBecause to do this means a server side redirect, which then forces everyone to use it... and not everyone can, or cares to.The goal here is to allow you to bookmark it as HTTPS or HTTP depending on your preference.I personally only care to use it HTTP simply for performance, things load faster.

author: RayRay
author_rank: Frequent Contributor
timestamp: April 03, 2017, 07:49:18 pm
content: Quote from: gnif on April 03, 2017, 07:43:06 pmWould that really be so bad? Pretty much all modern browsers support SSL nowadays. And I've never heard of any business/company blocking port 443 (as it's pretty much an essential) Now, apart from all that, SEO wise, EEVBlog would actually be ranked better on Google if https would be on by default, which is another thing to take into account.

author: rrinker
author_rank: Super Contributor
timestamp: April 03, 2017, 10:32:50 pm
content: How much further up does it need to be ranked? Google for eevblog, the first TWO pages of results are all Dave related, the first two hits being the blog and the forum. Even searching for "that crazy aussie bloke", the first 2 hits are Dave-related!I don't see much, if any, performance difference, but then I'm probably not too many hops away from the host being in the US, plus my connection is 150M+ down. Actually just tested now and I got 242 down, 12 up. I'm sure if I carefully measured page load times and whatnot there would be a difference, but that's like going to one step faster RAM in your computer, or the difference between an OC to 4.8GHz and one to 4.9GHz., a benchmark will see the speed difference but you'll never notice. Further away from the server, with more hops to traverse, yeah.

author: bitseeker
author_rank: Super Contributor
timestamp: April 04, 2017, 12:46:13 am
content: Quote from: rrinker on April 03, 2017, 10:32:50 pmLOL. I'd never have tried that for a search query.

author: gnif
author_rank: Unknown
timestamp: April 04, 2017, 12:53:24 am
content: Quote from: RayRay on April 03, 2017, 07:49:18 pmThis thread is not for this discussion, the decision has been made, and it is final, don't turn this thread into another argument on the merits of SSL. You didn't even have the option prior, don't complain about a free thing.

author: RayRay
author_rank: Frequent Contributor
timestamp: April 04, 2017, 01:13:00 am
content: Quote from: gnif on April 04, 2017, 12:53:24 amI might be taking a risk here (as you're in a power position) but I'm gonna stick to my principles and say what I have to say anyway.I was just asking a simple question (and was making some observations), and you're making it sound like I'm the bad guy for doing so, and quite frankly, I don't like it! i think you could've definitely been nicer in your response. It's not like I was hardcore complaining about it not being on by default. Also, if you're gonna make it an optional thing, at least put it on the spotlight!How bout some kind of big, clickable link on the top of the forums saying something like "Click here to load the forum in SSL mode"?Not everyone follows the news section FYI.

author: gnif
author_rank: Unknown
timestamp: April 04, 2017, 01:23:01 am
content: Quote from: RayRay on April 04, 2017, 01:13:00 amDude, it was not a personal attack on you, it was a clear statement for the general public because this has been discussed to death, there has been two other threads discussing this, one of which devolved into a bitter complaint about how we should enforce and implement HSTS and various other things. The other thread was about how people don't want it, and then here people are saying they want the option... If Dave wants to put it in the spotlight, start a thread and ask him, it is not my place to rule on this.As far as I am concerned, support both groups as best as possible while retaining full backwards compatibility is the best option here.Reasons for SSL:Security, obviously, but this is not a huge worry with the content of this websitePrevent content alteration by third parties such as governmentsPrevent your ISP from being able to track your browser habits so easily (they can still do it anyway)Reasons for not using SSL:Old browsers that do not support SNI or modern encryption schemes that people insist on usingHardware devices, scripts, etc that people have built that tie into the website may not support sslPerformance, SSL slows things down considerablyThere is no sensitive information here to protect, if there is you shouldn't be posting it on a public forum in the first placeEveryone assumes that SSL is the way to defeat tracking, alteration, etc... It is not, it just helps a bit. If a third party is determined enough to track you or alter the content there are numerous avenues of attack they can take, one of which is completely undetectable for thousands upon thousands of websites. it's called CloudFlare.I have seen people reset their passwords on this website since SSL was enabled, and fair enough... but how does that person know the server that is decrypting the SSL session has not been compromised? How do they know the admin of the server is competent enough to even notice if the server has had it's SSL private key stolen? And how do they know the owner/admin of that site is not just using it as a front to mine account details? And how do you know that the website that uses your password handles it correctly and stores it in a one way salted hash? Ultimately it comes down to blind trust in a random you don't even know from a bar of soap.If you think it's not that common, look at Sony... SSL was in use there but it was pointless as they stored all their data in plain text and allowed the theft of an enormous amount of data that they had been entrusted with. How did SSL help here? Would HSTS have prevented this? In short no. I bet the attacker felt good knowing that the information they were stealing was being stolen in a secure way, don't want to risk a theft of a theft.

author: gnif
author_rank: Unknown
timestamp: April 04, 2017, 03:40:50 am
content: Update: The post redirect issue has been fixed, all corner cases are now covered, if you load this site with HTTPS it should remain on HTTPS.

author: Monkeh
author_rank: Super Contributor
timestamp: April 04, 2017, 02:22:26 pm
content: This is just a quick test post as I seem to be having issues viewing some Youtube embeds..https://youtu.be/w4dYWhkSbTUE: Yes, there we go. youtu.be embeds don't seem to work over HTTPS.

author: bktemp
author_rank: Super Contributor
timestamp: April 04, 2017, 02:41:32 pm
content: It seems some browsers block non secure content:https://www.eevblog.com/forum/chat/test-post-yt-links/I have the same problem with Firefox. I can't see any youtu.be link, there is just an empty space instead of the video preview/link.

author: gnif
author_rank: Unknown
timestamp: April 04, 2017, 03:34:03 pm
content: Quote from: bktemp on April 04, 2017, 02:41:32 pmThanks! I will throw in a fix for this when I get a chance.Edit: Fixed

author: Monkeh
author_rank: Super Contributor
timestamp: April 04, 2017, 03:59:31 pm
content: No, thank you!

author: MLXXXp
author_rank: Frequent Contributor
timestamp: April 17, 2017, 02:43:46 pm
content: When I go tohttps://www.eevblog.com/ then selectForumfrom the menu bar, it takes me tohttp://www.eevblog.com/forum/Shouldn't theForumlink be tohttps://www.eevblog.com/forum/ ?The same appears to be true for theWikiandShoplinks.

author: gnif
author_rank: Unknown
timestamp: April 17, 2017, 03:04:20 pm
content: Quote from: MLXXXp on April 17, 2017, 02:43:46 pmYou would think, but that would need some additional changes to the install of wordpress that runs the forum, efforts have only been spent on the forums at this time.

author: gnif
author_rank: Unknown
timestamp: April 17, 2017, 11:03:09 pm
content: Quote from: wilfred on April 17, 2017, 09:59:51 pmNo subtle point at all, the link from the website to the forum generated by word press, I have not bothered to look at this yet due to time constraints.

author: gmb42
author_rank: Frequent Contributor
timestamp: July 07, 2017, 11:58:50 am
content: Chrome is showing mixed content loading, the advertising image for Opal Kelly is referenced via http:Code:Mixed Content: The page at 'https://www.eevblog.com/forum/buysellwanted/' was loaded over HTTPS, but requested an insecure image 'http://www.eevblog.com/images/comm/OpalKellyFPGA720x90.png'. This content should also be served over HTTPS.FWIW there's also an error with mathjax:Code:cdn.mathjax.org/mathjax/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML,Safe:32 WARNING: cdn.mathjax.org has been retired. Check https://www.mathjax.org/cdn-shutting-down/ for migration tips.