You can get a PositiveSSL for like 5 dollars per year, FYI 
2 Likes
Alright, true. But useless for people who like subdomains, if I understand the PositiveSSL website right.
You can get a wildcard cert for 60 per year 
1 Like
Well that I’m interested in. Would you mind providing a link?
1 Like
https://cheapsslsecurity.com/sslproducts/wildcardssl.html
A friend has used them before for non-wildcard certs, so I at least know they work. I’m still using Namecheap myself, as I only have one cert and I’m ok with paying an extra couple dollars to keep things in one place.
You’re kidding, right? Cost is not a barrier; StartSSL is free, WoSign (yay, China) is also free, CloudFlare’s just-use-a-selfsigned-cert-and-we’ll-fix-it-at-the-frontend SSL is also free.
5 Likes
I emit my own certificates. All I want is that the connections I establish to my host (which is at home btw) can be encrypted. When I feel it is necessary, I’ll move forward.
By emitting my own certificates, I’m able to customise everything about them, which is nice
@mbaxter: Thanks
@lukegb: I did find StartSSL, but that’s limited to 1 year and a single domain if I understand it right… WoSign has 2 years and 100 domains as option (looks actually kinda good), but you’re obviously right about CloudFlare, I totally forgot about that.
@Dannyps: I do that as well and it’s enough for me, but self-signed https connections are blocked by most browsers by default, afaik.
I’ve never had any trouble circumventing those protections. Anyway, I install my CA certificate on the pcs I work most with at school (I shouldn’t be able to…) so I don’t have that kind of trouble
Use cloudflare-giveus-a-self-signed-and-we’ll-fix-it-with-a-front-end-cert
This is getting kinda off-topic…
1 Like
What @TBotV63 said. This thread is for talking about the forum self downloading images, not about SSL certs.
1 Like
I’m questionning the potential security threat of downloading and self-hosting images from a remote source.
There is some potential. But it’s also an OCD thing.
Hrm… I wonder how much they validate those images, might have an arbitrary code execution vulnerability if they don’t validate them at all.
That’s what I was thinking yeah.
I believe the person on these forums best suited to answer that question is @riking. How is image downloading handled? Any processing other than changing links?
Not much processing other than the automated thumbnail creation if the image is wider than a post, which still happens even if the images aren’t downloaded; and adding width/height markers to the HTML so that the page doesn’t jump around.
Hm. Am I correct in guessing that it will download the image file behing a .php-source image? Otherwise it seems to me that @RobodudeMC and @Kornagan have a very valid point. If it does, however, it would at least serve as a protection for the users.
1 Like
They could always just have the server return a 404 to just Discourse, so it’s not exactly viable as IP discovery protection.