System Updates Thread ...7/21/20 . Security and Pictures

[RedSox3]

There's a Secure Sockets Layer (SSL) certificate in place, effective for about another 6 months.

A utility website, http://whynopadlock.com (enter net54baseball.com and click the "I'm not a robot" checkbox) shows that all the pieces of the puzzle are in place except one:

"Protocols: You currently have TLSv1 enabled. This version of TLS is being phased out. This warning won't break your padlock, however if you run an eCommerce site, PCI requirements state that TLSv1 must be disabled by June 30, 2018."

This doesn't sound like something we can fix ourselves, and the web hosting system administrators should probably do something about it.

What we found on the OBC site was that if there are any references to "http://" in any script producing a web page in the net54baseball.com domain, they should be changed to "https://" in the program script files. OBC had several dozen of those protocols that needed to be changed. I don't think users can easily change the vBulletin script files, and any changes would be overwritten when a newer version of vBulletin is installed.

In the meantime, as Leon said, even though the browser warns "Not secure," it'll behave like a regular secure website.

Best,
WMD

Wayne Delia, Webmaster, OBC (Old Baseball Cards), https://oldbaseball.com

[Leon]

Originally Posted by RedSox3

There's a Secure Sockets Layer (SSL) certificate in place, effective for about another 6 months.

A utility website, http://whynopadlock.com (enter net54baseball.com and click the "I'm not a robot" checkbox) shows that all the pieces of the puzzle are in place except one:

"Protocols: You currently have TLSv1 enabled. This version of TLS is being phased out. This warning won't break your padlock, however if you run an eCommerce site, PCI requirements state that TLSv1 must be disabled by June 30, 2018."

This doesn't sound like something we can fix ourselves, and the web hosting system administrators should probably do something about it.

What we found on the OBC site was that if there are any references to "http://" in any script producing a web page in the net54baseball.com domain, they should be changed to "https://" in the program script files. OBC had several dozen of those protocols that needed to be changed. I don't think users can easily change the vBulletin script files, and any changes would be overwritten when a newer version of vBulletin is installed.

In the meantime, as Leon said, even though the browser warns "Not secure," it'll behave like a regular secure website.

Best,
WMD

Wayne Delia, Webmaster, OBC (Old Baseball Cards), https://oldbaseball.com

Hey Wayne
The hosting company is currently restoring the attachment DB and doing what you had said to do. It is taking quite a bit of time..

I am not sure how to fix the HTTPS/lock issue as we have thousands (probably) of links that are http....
thanks again

.

[Ronnie73]

Originally Posted by Leon

I am not sure how to fix the HTTPS/lock issue as we have thousands (probably) of links that are http....
thanks again

I've used a program in the past from funduc.com that's a search and replace application. I've used it for similar changes such as updating a copyright date. It searches all the code and gives you the option to view each found example and apply the change one by one or you can change everything found with one click. It's also helpful when searching for certain code within a website and finding exactly what you were searching for and where it is. It saves a ton of time, especially when your dealing with a website that has many files. One of my websites has over 2500 files of code and it worked super fast every time I ever used it.

[Leon]

Originally Posted by Ronnie73

I've used a program in the past from funduc.com that's a search and replace application. I've used it for similar changes such as updating a copyright date. It searches all the code and gives you the option to view each found example and apply the change one by one or you can change everything found with one click. It's also helpful when searching for certain code within a website and finding exactly what you were searching for and where it is. It saves a ton of time, especially when your dealing with a website that has many files. One of my websites has over 2500 files of code and it worked super fast every time I ever used it.

Thanks Ron. I will look into it

I am also very aware of the issues the site security warning when logging in. They are being addressed. The site does have a security certificate. Just click through the security stuff. It only has to do with old http vs. https code. And on a mobile phone the lock shows.

Just spoke to the hosting company again...915am CST....they have applied the latest security cert but since they are not positive it will fix this I don't want to take the site down now for a reboot to apply the fix. The reboot is going to be done at 3am EST.....

.

[Rich Klein]

I think Richard "Dimples" Fields said all we need to know about Leon's month with this song

https://www.youtube.com/watch?v=qduCJYilnaY

Regards
Rich

[Leon]

The certificate upgrade was done last night but the security issues seem to remain (at least for me). So we will keep at it until it's fixed. The site is secure we just need to fix the old http links and make them https.....

After speaking with the hosting company this morning it looks like the process was done automatically and needed to be done manually. More to come later....

On the picture front, it is still being worked on too. It looks like the old pictures in the Community Photo album have been saved. Yay....
There is a chance the new ones (in the last week) can't be saved but we are still hopeful.
The 2 forum members working on the database have done an extraordinary job so far. We, especially me, owe then a debt of gratitude

[Leon]

It looks like the most recent security license update has cured some issues. We now have a padlock when on a pc. And we aren't getting that really awful looking security issue when logging in.... We are getting there....

Once these issues have settled down and we are stable for a short time (days) we will look at upgrading our s/w. The main thing is for the site to stay up and be stable.. I am in present discussions with the hosting company for more security to help prevent attacks in the future. WE will be addressing the backup policies and a lot more too....

And some 1946 Morley Studio cards....
.

[Joe_G.]

Originally Posted by Leon

On the picture front, it is still being worked on too. It looks like the old pictures in the Community Photo album have been saved. Yay....
There is a chance the new ones (in the last week) can't be but we are still hopeful.
The 2 forum members working on the database have done an extraordinary job so far. We, especially me, owe then a debt of gratitude

On the picture front . . . thank you! I'm not worried about losing last couple weeks of pictures, easy to recover. Fixing the several years that proceeded that was my concern and looks like you are well on the way to having that fixed. Many thanks to those working their tails off to fix the issues (that includes you Chris).

[irv]

Originally Posted by Leon

The certificate upgrade was done last night but the security issues seem to remain (at least for me). So we will keep at it until it's fixed. The site is secure we just need to fix the old http links and make them https.....

After speaking with the hosting company this morning it looks like the process was done automatically and needed to be done manually. More to come later....

On the picture front, it is still being worked on too. It looks like the old pictures in the Community Photo album have been saved. Yay....
There is a chance the new ones (in the last week) can't be but we are still hopeful.
The 2 forum members working on the database have done an extraordinary job so far. We, especially me, owe then a debt of gratitude

Yes, thanks, Leon. I now see all my photos have returned!

Appreciate all you did and continue to do to keep this site up and running!