# google says the sdmb is an unsafe site **URL:** \ **Category:** About This Message Board\ **Created:** [February 14, 2019, 1:05am UTC](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512 "2019-02-14T01:05:05Z")\ **Posts on this page:** 15\ **Page:** 4
**Author:** ![scabpicker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/scabpicker/32/8268_2.png) [@scabpicker](https://boards.straightdope.com/u/scabpicker)\ **Post date:** [February 28, 2019, 2:36pm UTC](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512/61 "2019-02-28T14:36:41Z")
> [@engineer\_comp\_geek](#): > > The default is https. > > If you come here from an external link, we have no control over that link. If it’s an http link, then you’ll get here with http instead of https. > > Any page served up from here should be https. Sometimes we miss things, though. > > This is why we keep asking exactly how you got that warning, because you shouldn’t be getting it at all. It would help us greatly if you explained exactly what you are doing. > > If you are using bookmarked links, you need to update your bookmarks. Well, it’s possible to redirect every http connection to an https one on every web server I’ve used. Since I’m not familiar with your setup, I can’t advise how, but it’s normally pretty simple if you have access to the configuration. ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [February 28, 2019, 2:38pm UTC](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512/62 "2019-02-28T14:38:36Z")
> [@engineer\_comp\_geek](#): > > The default is https. > > If you come here from an external link, we have no control over that link. If it’s an http link, then you’ll get here with http instead of https. Most sites would then redirect you to the HTTPS version. But the SDMB no longer seems to do that. I do have at least one bookmark to an old HTTP version, and it used to take me to the HTTPS version. Now it doesn’t. This does have the advantage that, if there are any other certificate errors, you could still reach the site by going to the HTTP version. But it also means some people may see the “Not Secure” indicator if they are on the HTTP version. And passwords would be sent in the clear. Personally, I like the idea of maintaining a distinction between HTTP (insecure) and HTTPS (secure) sites, but that does not seem to be the direction the Internet is going. ---
**Author:** ![Babale](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/babale/32/15666_2.png) [@Babale](https://boards.straightdope.com/u/Babale)\ **Post date:** [February 28, 2019, 3:07pm UTC](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512/63 "2019-02-28T15:07:02Z")
For what it’s worth – the SDMB did use to redirect you to the secure site, but I just checked five or six other forums (including the Giraffe boards) and they all either don’t have security credentials at all (So going to the https site results in an error/warning) or do have an S site but don’t redirect you (Giraffe Boards, for one!). So the SDMB is par for the course on this. ---
**Author:** ![Fenris](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fenris/32/498_2.png) [@Fenris](https://boards.straightdope.com/u/Fenris)\ **Post date:** [February 28, 2019, 8:42pm UTC](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512/64 "2019-02-28T20:42:56Z")
> [@Babale](#): > > Did your expert mention that you can add an S to the end of HTTP and access the secured site, which the admin DID go through the effort to solve? > > Not much of an “expert” :smack: Yeah, that “expert” sounds like a real mouthbreather. ---
**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\ **Post date:** [February 28, 2019, 9:10pm UTC](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512/65 "2019-02-28T21:10:36Z")
As I mentioned in an earlier post, and as others have mentioned, it should be possible to configure the server to redirect all requests, both https and http, to https. Other sites do this. Surely your tech folks can figure it out. ---
**Author:** ![Helena330](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/helena330/32/531_2.png) [@Helena330](https://boards.straightdope.com/u/Helena330)\ **Post date:** [February 28, 2019, 9:24pm UTC](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512/66 "2019-02-28T21:24:01Z")
> [@Babale](#): > > You probably have the old http site bookmarked or something. Note how nobody else is experiencing this issue. That’s why I was asking how you access the site. We can help you figure out the issue on your end. I was until I changed my bookmark to https. Although this problem needs to be fixed at the server level, at the individual level it’s pretty simple. ---
**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\ **Post date:** [February 28, 2019, 9:43pm UTC](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512/67 "2019-02-28T21:43:43Z")
I just did some experiments. [http://www.straightdope.com](http://www.straightdope.com) automatically redirects to https. [boards.straightdope.com](http://boards.straightdope.com) does NOT do this. If you type it in starting with http (or without a prefix) it returns a non-secure http page. At least all of that is true for me. So it looks like the “www” subdomain works as it should and always returns a secure page, but the “boards” subdomain only returns a secure page if you specifically request one by specifying https. The server is apparently misconfigured so that only the www subdomain redirects to https. Or maybe the two subdomains are on different servers and only the one is configured properly. ---
**Author:** ![Babale](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/babale/32/15666_2.png) [@Babale](https://boards.straightdope.com/u/Babale)\ **Post date:** [February 28, 2019, 9:59pm UTC](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512/68 "2019-02-28T21:59:54Z")
> [@davidm](#): > > As I mentioned in an earlier post, and as others have mentioned, it should be possible to configure the server to redirect all requests, both https and http, to https. Other sites do this. Surely your tech folks can figure it out. It’s definitely possible, and something that TPTB should absolutely do. And as a few people said, the Dope used to redirect us just fine. OTOH, it does seem that many other sites have the same issue. ---
**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\ **Post date:** [February 28, 2019, 10:20pm UTC](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512/69 "2019-02-28T22:20:30Z")
Configuring the server properly can be tricky but not too difficult if you know what you’re doing, but It can be easy to miss the fact that it’s not working on all subdomains. ---
**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\ **Post date:** [February 28, 2019, 10:55pm UTC](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512/70 "2019-02-28T22:55:12Z")
I did some more research. The two subdomains, “www” and “boards”, resolve to two different IP addresses, so they’re probably on different servers. “boards” looks like it’s being served from a virtual machine using Google’s cloud service. So the virtual machine is probably not configured properly. At least I hope that misconfiguration on our end is the problem. I’d hate to think that Google’s cloud service would have such an egregious bug, but anything’s possible. ---
**Author:** ![Babale](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/babale/32/15666_2.png) [@Babale](https://boards.straightdope.com/u/Babale)\ **Post date:** [February 28, 2019, 11:34pm UTC](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512/71 "2019-02-28T23:34:01Z")
I wouldn’t call allowing access to the http site a “bug”. There are valid reasons to access a site through an http connection. ---
**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\ **Post date:** [February 28, 2019, 11:44pm UTC](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512/72 "2019-02-28T23:44:24Z")
> [@Babale](#): > > I wouldn’t call allowing access to the http site a “bug”. There are valid reasons to access a site through an http connection. Sure, but why would they configure the SDMB to be accessible via http? When I called it a bug I was talking about the possible case where the SDMB’s tech people have it configured to always redirect to https (which is how it should be) but a bug is preventing that from happening. Of course I don’t know that that’s the case. I’m speculating. The more likely case is that the SDMB techs have it misconfigured. ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [March 1, 2019, 12:05am UTC](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512/73 "2019-03-01T00:05:21Z")
> [@Babale](#): > > For what it’s worth – the SDMB did use to redirect you to the secure site, but I just checked five or six other forums (including the Giraffe boards) and they all either don’t have security credentials at all (So going to the https site results in an error/warning) or do have an S site but don’t redirect you (Giraffe Boards, for one!). So the SDMB is par for the course on this. It’s possible these old style forums are the exception, but most sites in general do redirect you if you go to the HTTP site. Try going to [http://en.wikipedia.org](http://en.wikipedia.org) or [http://www.google.com](http://www.google.com) or [http://reddit.com](http://reddit.com) or [http://twitter.com](http://twitter.com) and so on. And here’s a link to GoDaddy flat out saying you NEED to redirect it: [Redirect HTTP to HTTPS automatically | Linux Hosting (cPanel) - GoDaddy Help US](https://www.godaddy.com/help/redirect-http-to-https-automatically-8828) ---
**Author:** ![Cleophus](https://avatars.discourse-cdn.com/v4/letter/c/a88e57/32.png) [@Cleophus](https://boards.straightdope.com/u/Cleophus)\ **Post date:** [March 1, 2019, 12:24am UTC](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512/74 "2019-03-01T00:24:58Z")
> [@davidm](#): > > I did some more research. The two subdomains, “www” and “boards”, resolve to two different IP addresses, so they’re probably on different servers. > > “boards” looks like it’s being served from a virtual machine using Google’s cloud service. So the virtual machine is probably not configured properly. > > At least I hope that misconfiguration on our end is the problem. I’d hate to think that Google’s cloud service would have such an egregious bug, but anything’s possible. It doesn’t have anything to do with Google cloud services. Google isn’t managing the SDMB’s server(s), it’s just running on their virtual machine platform. The reason the “Not Secure” message appears in Chrome is that Google programmed the message to appear for all pages served over HTTP, with the enhanced red warning appearing if you start to type data into to the page. In the past, Chrome and other browsers would not do this. The change was rolled out for Chrome version 68, in July 2018. In other words, the very same website and configuration would not be flagged with the warning prior to v68, and be flagged in v68 and newer. For some reason, perhaps related to the SSL certificate change that occurred earlier, the redirect to-HTTPS configuration was lost. It appears to have been restored. ---
**Author:** ![Kolak\_of\_Twilo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kolak_of_twilo/32/73_2.png) [@Kolak\_of\_Twilo](https://boards.straightdope.com/u/Kolak_of_Twilo)\ **Post date:** [March 1, 2019, 5:32am UTC](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512/75 "2019-03-01T05:32:34Z")
Yep, I just typed [http://boards.straightdope.com](http://boards.straightdope.com) and it loaded the https version of the site so it looks to have been fixed. And I was using Chrome. [Previous page](https://boards.straightdope.com/t/google-says-the-sdmb-is-an-unsafe-site/829512.md?page=3)