VS forum and Firefox Security Issue

[Old_Friend]

Please see the attachment... I finally figured out how to attach an image.

[Davidk]

What version of Firefox are you using???

Update
Wikipedia has an extensive article on TLS, herehttps://en.wikipedia.org/wiki/Transport ... ty#TLS_1.1
The current version of TLS is 1.3 (2018), with earlier versions 1.0 (1999), 1.1(2006) and 1.2(2008). The aging and superseded versions are clearly being "removed" in firefox, and chrome rates a mention in that wiki article as well.

This is something the admins should be drawing Corels attention as a matter of some urgency.

[canuck]

I have had that message appear quite a few times and it has nothing to do with VS directly. It has appeared with all sorts of website even when I tried to log on to my Banks website. Without changing any TLS, I simply tried the login again and it works.

[Ken Berry]

It's not so much to do with VS, no, but for users who have Firefox it is more to do with access to the whole forum website and all its sub-forums. Anyway, we have raised it with the Corel techs. They've told us that it is a problem with the OS on which our forum is currently built. They will need to develop a new OS for the forum to be built on which I imagine will apply to all browsers. They say this will add security more generally, but as you might expect, it will take some time...

[Old_Friend]

Attn: Davidk:

What version of Firefox are you using???

I had just updated to Firefox ver. 4.0 before I visited this forum.
* Thank you all for your replies. Topic is resolved.

[Davidk]

Old_friend,
version 4.0 was back in the dark ages. Do you mean v74.0?

[Davidk]

I guess he did . . . I got a Firefox upgrade message to v74.0, and afterwards, logging to this site produced exactly the same result as posted above. Clicking the enable TLS1.0 and 1.1 buttons got me access, but note in the image posted above the statement that this TLS version capability (1.0,1.1) will be removed from future versions of the browser and at that point any web site that hasn't updated TLS will go dark to the browser. That could include the Corel main application site: being unable to sell software thru it would I think be something Corel would urgently want to fix.

As to needing a new OS for the host: candidly, that's a smokescreen. Host OS for servers are few (2 or 3?) and users simply don't write them; they are too complex for that. Servers are just like a desktop: OS software that runs the hardware and allows apps to do specific functionality, and in a server case over many apps and users at once: rather more complex than windows. The apps they run (like PHP, which this forum runs on) are just functionality guests. So what the host support technicians really have to do is patch the host OS for the later version(s) of TLS (note that the version the browsers want - TLS 1.2 - has been published for over 10 years, something they have probably conveniently not done).

[Old_Friend]

Attn: Davidk
Woops! That was a typo on my part. I fixed it.

[Ken Berry]

That could include the Corel main application site: being unable to sell software thru it would I think be something Corel would urgently want to fix.

I suspect the main Corel website runs on quite different settings to those of our forums. I'd be surprised in the main website raised any alarms on any of the browsers. Our PHP basic software running the forums, however, is pretty primitive by modern standards and we have pressing for quite a few years now to upgrade or change it. I suspect this is what our Corel contact may have been talking about. At least I hope so...

[Davidk]

Hi Ken,
PHP is a pretty popular platform - I've run into it many times. Whether Corel is using the latest version may be an issue, but IMHO isn't likely to affect this problem. TLS (Transport Layer Security) replaced the more generally known (to us oldies) SSL methods - a good article on wikipedia here https://en.wikipedia.org/wiki/Transport_Layer_Security - and is something that applications generally don't have to care about - it's taken care of the by the communications package in the host. And for servers, the host OS usually comes with the server hardware.