SSL Certificate, please add this.

[Aderm]

I've seen other threads on this, and it was denied because it costs money.
Thing is, cloudflare provides a free ssl in their Security tab.

Why SSL?
It's secure. It encrypts logins and data transmitted between the user and server.

What about external images using HTTP?
Xenforo has an image proxy built right into it, find it:
Settings > Options > Messages > Image and Link Proxy

Please, please add this. It's so simple and gives extra security.

 

[Aderm]

This has already been suggested multiple times.

I know that. It's beyond me why it's been denied but yk.

 

[hiimphil]

I completely agree with this.

How come a marketplace website doesn't have https:// before the urls?

This has been suggested before but not implemented which is ridiculous for this type of website.

EDIT: It works fine with flexible too. You can put this code on with flexible to enforce SSL:

<?php if($_SERVER['HTTP_X_FORWARDED_PROTO'] != 'https') {
    header("Location: https://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]);
    exit();
}?>

 

[Justis]

It's not that SSL itself would cost a significant amount of money, but the loss of revenue from google adsense due to the massive reduction in available and highly profitable ads created for SLL sites would be equally massive.
The fact that MC-Market doesn't actually handle any significant personal information coupled with that loss of revenue every day that we're encrypted makes it a tough move to even consider just for the sake of "looking" safer with the s at the end of our http.

Personally, I'd like for it to be added in the future, if only for that sake of "looking better" for kiddos who are obviously overly concerned; with some sort of counter measure to the loss in revenue, perhaps offering up ads in place of google adsense ads, (which would also only be seen by non-premium members, though, there's no way they'd sell as much as our sidebar ads)
Ideas for the future are good.
However, I'm growing tired of seeing this suggestion made over and over and argued amongst people who honestly have no idea exactly what SSL does to make a site like us "more secure".

 

[Fire]

I know that. It's beyond me why it's been denied but yk.

http://www.mc-market.org/threads/122340/
http://www.mc-market.org/threads/112499/
http://www.mc-market.org/threads/148877/
http://www.mc-market.org/threads/238082/
http://www.mc-market.org/threads/158975/

Read through all of these. They are all the same suggestion full of replies, including why it gets denied.

 

[hiimphil]

It's not that SSL itself would cost a significant amount of money, but the loss of revenue from google adsense due to the massive reduction in available and highly profitable ads created for SLL sites would be equally massive.
The fact that MC-Market doesn't actually handle any significant personal information coupled with that loss of revenue every day that we're encrypted makes it a tough move to even consider just for the sake of "looking" safer with the s at the end of our http.

Personally, I'd like for it to be added in the future, if only for that sake of "looking better" for kiddos who are obviously overly concerned; with some sort of counter measure to the loss in revenue, perhaps offering up ads in place of google adsense ads, (which would also only be seen by non-premium members, though, there's no way they'd sell as much as our sidebar ads)
Ideas for the future are good.
However, I'm growing tired of seeing this suggestion made over and over and argued amongst people who honestly have no idea exactly what SSL does to make a site like us "more secure".

MCM Makes enough profit to stay running. Adsense automatically proxies links to run on SSL so it shouldn't make any difference to the operations of the website. For a website so big (rank 20,130 in the USA) it's in the top 1%of websites, and for a modern website that handles people selling things, even via a third party the peace of mind knowing that any data such as private messages for any purpose or my own login can't as easily be sniffed with SSL.
https://thirsty.agency/ssl/ - this blog post re-iterates what I'm saying about why having SSL on any website is so vital. One that handles financial email and contact addresses, and potentially things such as PayPal logins should be secured.

It's not even a case of "add ssl to mcmarket" - MCMarket has SSL, however redirects people to the insecure version of these pages. How is it that a website so powerful and big can be so insecure with data? The website is very well made, has a nice User Interface and is fast. This website can easily "afford" to run SSL. It would be free, but as I have already stated Adsense uses SSL already.

This shouldn't be any issue at all. When I was looking through google's help, I saw nothing about AdSense being blocked by SSL. It may potentially open up market for better sites.
If we do the maths, MCMarket will cost quite a lot to run, potentially up to $250-500 a month. Keep in mind that an estimate of how many MCMarket active users is potentially 25% Premium users and 15% supreme, along with gradient names, adsense and user ads, you can see that there is a high amount of profit coming in, as the Alexa ranking for this website is 20,130 in the USA. That's a lot of traffic.

Again, I request that SSL is added to drastically increase the security of the website for Client->Server and Server->Client connections.
Thank you.

 

[Justis]

MCM Makes enough profit to stay running. Adsense automatically proxies links to run on SSL so it shouldn't make any difference to the operations of the website. For a website so big (rank 20,130 in the USA) it's in the top 1%of websites, and for a modern website that handles people selling things, even via a third party the peace of mind knowing that any data such as private messages for any purpose or my own login can't as easily be sniffed with SSL.
https://thirsty.agency/ssl/ - this blog post re-iterates what I'm saying about why having SSL on any website is so vital. One that handles financial email and contact addresses, and potentially things such as PayPal logins should be secured.

It's not even a case of "add ssl to mcmarket" - MCMarket has SSL, however redirects people to the insecure version of these pages. How is it that a website so powerful and big can be so insecure with data? The website is very well made, has a nice User Interface and is fast. This website can easily "afford" to run SSL. It would be free, but as I have already stated Adsense uses SSL already.

This shouldn't be any issue at all. When I was looking through google's help, I saw nothing about AdSense being blocked by SSL. It may potentially open up market for better sites.
If we do the maths, MCMarket will cost quite a lot to run, potentially up to $250-500 a month. Keep in mind that an estimate of how many MCMarket active users is potentially 25% Premium users and 15% supreme, along with gradient names, adsense and user ads, you can see that there is a high amount of profit coming in, as the Alexa ranking for this website is 20,130 in the USA. That's a lot of traffic.

Again, I request that SSL is added to drastically increase the security of the website for Client->Server and Server->Client connections.
Thank you.

Asense supports SSL, but not all of their ads do. SSL has strict requirements that must be met by ad creators in order to be used on SSL sites. There are nowhere near as many ad creators submitting SSL compliant ads to the ad pool for SSL sites.
Not nearly as many ads means not nearly as much competition, and the $ those ad creators have to offer for their ads to be seen is also not nearly as high. Meaning less revenue for the SSL sites hosting those SSL compliant ads.

I'm not sure where you've gotten your 25% and 15% figures, but having had access to our adsense account and history back when Bebos was running the site, and even knowing that we've continued to grow in traffic since then, I can tell you the adsense income is not negligible.

If we want to switch to SSL in the future, we first need to start thinking of a way to replace adsense, and as I said in my previous message, compensate for the loss of revenue from abolishing it, rather than simply jumping up and down and demanding SSL SLL SSL right now right now right now. That is not how we progress.

 

[Khaled E.]

Cant you make smth like a subdomain pointing to the login page?
And making that sub domain have SSL?

I am not expert so tell me if I am wrong :I

 

[hiimphil]

Even if you got a good point, Mick will deny it as you can't run SSL over MC-Market as it'll need a lot of things to be done after its installed.

Hence me saying "set it to flexible".

You don't need to install any software as it's all direct. You need to put one thing on /library/config.php and you're good to go.

Cant you make smth like a subdomain pointing to the login page?
And making that sub domain have SSL?

I am not expert so tell me if I am wrong :I

This isn't possible with XenForo

 

[Khaled E.]

More work to do, so no.
You need to reinstall xenforo and shits to do that.
And Its tons of more work.

Well atleast it can happen.

Meh what is the issue of not having SSL as of now?

I mean you are stupid if you use the same password on paypal or any other sites
you shouldnot do that under any case

 

[hiimphil]

Well atleast it can happen.

Meh what is the issue of not having SSL as of now?

I mean you are stupid if you use the same password on paypal or any other sites
you shouldnot do that under any case

Not only is it secure, it adds to the professionalim of this website - a marketplace. Marketplace + Professionalism is normally a pretty good thing, huh?

 

[Aderm]

You need to reinstall xenforo and shits to do that.

you really, really don't.

 

[Khaled E.]

Not only is it secure, it adds to the professionalim of this website - a marketplace. Marketplace + Professionalism is normally a pretty good thing, huh?

Maybe

not to mention google chrome is marking any site as Insecure these days.

 

[Theo J]

https://chrome.google.com/webstore/detail/https-everywhere/gcbommkclmclpchllfjekcdonpmejbdp?hl=en[DOUBLEPOST=1507830382][/DOUBLEPOST]

Maybe

not to mention google chrome is marking any site as Insecure these days.

do you have any idea how this works? google chrome isn’t marking sites insecure randomly. you either have a secure site, or you don’t. chrome isn’t different than any other browser. lol

 

[hiimphil]

Alright let me phrase this quite differently.

Google, Facebook and Twitter don't usually involve any form of payment. You sometimes buy things on them, but as frequently as you would on MCM.

Why don't we have SSL when they do?

 

[NotSoBoop]

Here is my 2 cents on this:

Yes, Justis is correct about the massive drop in revenue from switching to https from http, simply looking over the Google product forums, people have lost over 60% of their adsense revenue just by switching. However, I believe that SSL should be given a try. I understand that MC-Market has their own bills to pay, so my proposal is that after all essentials are paid (staff pay [if they get any], website hosting, mick's pay [if he gets any], etc.), attempt a switch to https for the remainder of that month (albeit, 1-2 days might not be a sample size big enough), and check if that amount is still enough to pay the essentials. If it is, just try it a bit more longer, and keep "trying it" longer until it reaches a point where utilizing SSL is no longer having financial drawbacks. If projected numbers no longer allow you to pay for essentials, switch back to non-ssl.

Another suggestion (I prefer the first one a lot more):

Get rid of AdSense and monetize the site a lot more. GetBukkit is one of my favorite examples of a monetized website. Every single page of theirs has banners, their download buttons have a "Create a server" feature that allows for even more monetization, and they probably make over $500/monthly on just advertisements alone, split between 2 owners. GetBukkit is rank 60,911 at time of posting in the US (according to Alexa). MC-Market is at a whopping rank 20,130 (according to Alexa) in the US. MC-Market is visited 3x as much, and I can almost guarantee there are companies/individuals who'd be willing to pay a very high price in order to get banners on the website. Here is where I propose that these banners be located:

Spoiler: Banner Locations

Top of page (already exists pretty sure)
Sidebar (already exists)
In-between posts (maybe 1 banner in-between posts per page)
Footer banner (not sure if this already exists)

Another place that banners could be placed in is external links. When linking to an external link, have one of those confirmation pages, and right under the "Take me to the external site" button or something of the sort, include a banner (or above, who knows). Automated shoutbox advertisements could also exist (I support this because I view the shoutbox as an advertisement site, I don't really strongly believe in a social network taking place on a marketplace website - however, I know the majority do, so this would have to go up for debate).

Relying on only banners could also have a very distinct advantage. They'd be able to counter adblockers. If you host the client's banners on your own site, I severely doubt that AdBlockers would start blocking images on your site, which could allow for a high conversion rate, especially since more people would be exposed to these advertisements.

However, these points are just arguing banners. There are a lot more things that could be monetized on the site, such as:

Spoiler: Monetizable things

Or however you spell "monetizable" if it is even a word idk

More aggressive sticky thread advertisements
Banners (already mentioned)
Custom thread backgrounds/themes (sort of like the app store, not sure how this would work but it's whatever)
Custom tags to threads (maybe like "CLICK ME", etc.)
Custom thread colors (Change thread title color in the list to green or something, make the thread stand out)
More name colors
Ability to bump more frequently
etc. etc.

Being able to monetize the site a lot more could be the replacement for AdSense that would allow for SSL to take place.




Disclaimer: I'm aware that SSL used to be on MC-Market, but I don't recall AdSense being the major problem, I remember images and links not loading properly since all were being forced to load on https rather than proxied, and the offsite images tended not to work well at all, especially when images were hosted on a website without https enabled. However, my memory of this isn't very clear, so don't quote me on that. Please.

Also, I probably won't respond to any quotes of this post as I don't tend to post non-business posts anymore, however, if your reply is worded neatly or you are arguing for/against my points with other valid points, I might respond.