NetSurf OS3 official development builds

[utri007]

Then it's a problem with the website configuration, as it's either redirecting you or some page elements are being served over SSL (or the OS3 build of NetSurf is completely broken, which it is in parts).

Both amiga.org and Amigaworld.net? Hard to believe?

[chris]

Both amiga.org and Amigaworld.net? Hard to believe?

Common owner.... but I've never seen them redirect to https on any browser, including NetSurf.  Maybe deleting your cache will fix it?

[utri007]

Common owner.... but I've never seen them redirect to https on any browser, including NetSurf.  Maybe deleting your cache will fix it?

Cache deleted. Amiga.org was OK, but amigaworld.net asked accept morph.zone certificate??

After that going baack to amiga.org was impossible, though I only waited about 2 minits.

[utri007]

Tested it again, amiga.org OK -> aminet.net OK -> amigaworld.net certifigate error morph.zone - > amigans.net certifiaget error paypal.com??

Maybe ssl should be disabled until it works again? Other hand, nobody use 68k netsurf for any serious stuf, so maybe ssl is just not needed?

[chris]

Tested it again, amiga.org OK -> aminet.net OK -> amigaworld.net certifigate error morph.zone - > amigans.net certifiaget error paypal.com??

Ok, the certificate errors are likely because OpenSSL doesn't work properly.

Maybe ssl should be disabled until it works again? Other hand, nobody use 68k netsurf for any serious stuf, so maybe ssl is just not needed?

Given it's beta, it can stay broken until somebody* fixes it.

* Most probably me, given that nobody else appears to have the slightest interest in looking at it.

[kolla]

For what it is worth...
* the certificate used on amigaworld.net expired 1582 days ago
* the certificate used on amiga.org it is not even issued to amiga.org, nor contain amiga.org as alternate name
* the certificate used on amigans.net is issued to and signed by localhost.localdomain

Any sane browse will explicitly _not work_ with the above domains.

These *three* domains show all signs of being run by amateurs

(I'm sure the list will grow)

Please use some real-life, well-maintained and functional domains/sites for testing TLS/SSL.

[eliyahu]

@kolla

just as an FYI.... if you see anything around the site that needs fixing -- especially from a security point of view -- please PM @amigakit to let matthew know. thanks!

-- eliyahu

[utri007]

For what it is worth...
* the certificate used on amigaworld.net expired 1582 days ago
* the certificate used on amiga.org it is not even issued to amiga.org, nor contain amiga.org as alternate name
* the certificate used on amigans.net is issued to and signed by localhost.localdomain

Any sane browse will explicitly _not work_ with the above domains.

These *three* domains show all signs of being run by amateurs

(I'm sure the list will grow)

Please use some real-life, well-maintained and functional domains/sites for testing TLS/SSL.

Check pictures, it was asking morph.zone and paypal.com certifikates. I'm prety sure tahat earlier it asked amiga.org and amigaworld.net certifigates. I can't understat how / it decided to ask those paypal / morph certifigates.

[kolla]

Check pictures, it was asking morph.zone and paypal.com certifikates.

Yes... I am guessing missing CA certificates installed in/for your browser.

I'm prety sure tahat earlier it asked amiga.org and amigaworld.net certifigates. I can't understat how / it decided to ask those paypal / morph certifigates.

It asks for those because there is content on the amigaworld.net page from those pages - like the https://library.morph.zone/logo.png on the amigaworld.net article regarding MorphOS 3.10 release, and a paypal logo under "Support us!" on the amigans.net page. Nothing magic here.

[kolla]

@kolla

just as an FYI.... if you see anything around the site that needs fixing -- especially from a security point of view -- please PM @amigakit to let matthew know. thanks!

-- eliyahu

Really? You expect me and others to remember this?

No, I don't go there - the site owners should get the feces together - this stuff is rudimentary and obvious. I have earlier tried to use the "contact us" that is linked to at the bottom of this page, without seeing any response nor action. I have also tried using the addresses specified in whois ("Tech Email: contact@a-eon.com") in futile attempts at reporting issues regarding fubar DNS etc. (http://amigaworld.net/modules/newbb/viewtopic.php?mode=viewtopic&topic_id=452&forum=7&start=380&viewmode=flat&order=0#761384) which led to absolutely nothing - if these obvious contact points don't work, then "amateurs" is a fitting description IMO.

[wawrzon]

i think a decent browser behaviour today would be to (decently) warn the user the site was not secure and navigate towards it nevertheless. im using different browers across my systems and all they do moreless the same, as chrome atm, they mention the handicap.

[wawrzon]

@kolla

just as an FYI.... if you see anything around the site that needs fixing -- especially from a security point of view -- please PM @amigakit to let matthew know. thanks!

-- eliyahu

lets not delude us. the sites are as good as unmaintained, thats sure. about as much as moobuny once was. and they are probably about as secure. who cares. free world.. and such. lets just not act as if there was any staff to take actions. let alone anyone qualified to do that. even though people here claim to hold positions in it industry.