[Update Aug 25] MAL Gets Secured (SSL)!

Aug 24, 2016 5:19 AM

#101

PrimaIlham

Offline

Aug 2016

Like this pocket mall

Aug 24, 2016 10:07 AM

#102

evyyy

Offline

Apr 2015

284

That's good to hear

Aug 24, 2016 10:53 AM

#103

motoko

Offline

Mar 2012

158

[quote=Plutia message=47477170]

begija said:
Seems they didn't implement it along with HSTS though.. :3

Probably better to make sure it works properly before implementing that, as undoing the caching is not an easy thing. You know how MAL always seems to have bugs on new stuff.

Developer, sysadmin, and anime addict.
Have an Android smartphone? Try Atarashii!

Aug 24, 2016 12:46 PM

#104

Tenth

Offline

Jul 2010

8334

Xinil said:
Finally, if you are using any custom userscripts with a browser add-on like TamperMonkey, you may find that your URLs need to be updated to HTTPS.

Thank you for telling that, actually really informative since I was really confused as to why some of my userscripts stopped working.

Aug 24, 2016 3:14 PM

#105

Hshr

Offline

Apr 2016

nice, can your next project be making a fully featured RESTful API please?

"Lost, confused..
Losing sight of myself, I grow desperate and struggled
Each time I heard the sound of the bell, I struggled
I wondered, "where is the one who matters most to me?"
Really, I knew the answer the whole time.
I finally came to the realization after she showed me the way home.
I was able to decide that this is where I would live.
This is one of my precious bell's memories."

Aug 24, 2016 3:36 PM

#106

TommasoScalici

Offline

Jan 2014

Xinil said:

Also, in order to allow our 3rd party developers ample time to update their applications, we’ve decided to allow our API to support both HTTP and HTTPS for about 3 weeks. Please update your application(s) as soon as possible. By mid-September, the API endpoints will only use HTTPS.

That's great, I was about to miss this, but it seems I have still time to update my third party client/app. By the way, a little OT: any plans about giving a "refresh" to the API too? It's really old, somewhat broken in some cases, etc.
I hope there'll be news on that front too.

I developed a MyAnimeList App for Windows 10!
Check it out if you're interested. :)

Aug 24, 2016 6:20 PM

#107

motoko

Offline

Mar 2012

158

TommasoScalici said:

That's great, I was about to miss this, but it seems I have still time to update my third party client/app.

Part of that is due to having to parse HTML to get data from MAL. With the change, the URLs inside the pages changed. Also, if the parser is detecting redirects (for certain reasons), then the http to https redirect breaks that.

TommasoScalici said:

By the way, a little OT: any plans about giving a "refresh" to the API too? It's really old, somewhat broken in some cases, etc.
I hope there'll be news on that front too.

Same. The official API is a joke. I've offered many times for MAL to use the API I help develop as an officially supported tool. It's quite full-featured too.

Developer, sysadmin, and anime addict.
Have an Android smartphone? Try Atarashii!

Aug 24, 2016 7:24 PM

#108

LAFWAN

Offline

Jan 2016

Great!

┛|[ LAFWAN ]|┗

Aug 24, 2016 7:34 PM

#109

Soren

Offline

Jul 2013

18193

Ayyy http op. Nice update mal , I've been waiting for this

Aug 24, 2016 7:53 PM

#110

gwennie-chan

Offline

Jun 2015

You should submit the website to HTTPSEverywhere now.

"When I grow up I want to be a housewife!" - Misaki Kamiigusa (Sakurasou no Pet na Kanojo)
"I hope one day, you'll be reunited with the person you cherish." - Isla (Plastic Memories)

Aug 24, 2016 8:23 PM

#111

Apocist

Offline

Jul 2007

Awesome to see security getting in place! Those external images are going to be a pain to deal with though.

Aug 24, 2016 8:50 PM

#112

LordHighCaptain

Offline

Mar 2009

Also, in order to allow our 3rd party developers ample time to update their applications, we’ve decided to allow our API to support both HTTP and HTTPS for about 3 weeks. Please update your application(s) as soon as possible. By mid-September, the API endpoints will only use HTTPS.

Contrary to the above, http://myanimelist.net/malappinfo.php?status=all&type=anime&u=lordhighcaptain redirects to https.This breaks my site since mono does not have any root certificates installed by default.

Aug 24, 2016 10:06 PM

#113

Gaichi

Offline

Jul 2011

3921

+1 for more security! :D

"A half moon, it has a dark half and a bright half, just like me…", Yuno Gasai

Aug 24, 2016 11:30 PM

#114

motoko

Offline

Mar 2012

158

LordHighCaptain said:
Contrary to the above, http://myanimelist.net/malappinfo.php?status=all&type=anime&u=lordhighcaptain redirects to https.

I believe malappinfo.php was deprecated in 2009 with a replacement "soon". Not surprised that it would be overlooked (or that MAL would find some way to cause issues).

LordHighCaptain said:
This breaks my site since mono does not have any root certificates installed by default.

I expected that it would default to the system trust, but you're right. It doesn't have anything in the default trust. It does look like Mono v3 and above has a sync tool, and the docs claim it runs when Mono is installed. If you need a source though, the cURL site has a nice CA bundle you can import at https://curl.haxx.se/ca/cacert.pem. It's converted from the default Mozilla trusted roots.

BTW, my public offer of API assistance to MAL still stands. I'd be happy to provide code and help to get a proper API running so we don't have a bunch of third-party solutions breaking in wild ways.

Developer, sysadmin, and anime addict.
Have an Android smartphone? Try Atarashii!

Aug 25, 2016 1:14 AM

#115

Malarkey

Offline

May 2015

2588

if this is why my list is broken, kms

Freddy Nicholas said:
have control, be yourself, god is dead

Aug 25, 2016 1:59 AM

#116

Kineta

Lead Admin

Faerie Queen

Offline

Aug 2007

6262

Update August 25
Trouble logging in? / Getting 400 errors? Please whitelist myanimelist.cdn-dena.com in your script blockers. This is not a 3rd party website (MAL is owned by DeNA). @Canadian-OhTaKu

CSS import problems for anime/manga list designs? Please host your CSS file(s) on a website which supports HTTPS (e.g. Dropbox). Unfortunately, it is not possible for us to enable HTTP imports on anime/manga lists.

Why doesn't the "secured" symbol appear on profile/forum pages? This is due to mixed content on the pages (images in the About Me / posts which are from non-HTTPS sources). We decided it would be unnecessarily restrictive to require all images embedded by users to come from HTTPS sources.

KinetaAug 25, 2016 3:19 AM

Join MAL's Mod Team!　✧　
Guidelines & FAQ　✧　

Watch Cool Doji Danshi~　✧　

Aug 25, 2016 2:54 AM

#117

IATGOF

Offline

May 2010

243

motoko said:

TommasoScalici said:

By the way, a little OT: any plans about giving a "refresh" to the API too? It's really old, somewhat broken in some cases, etc.
I hope there'll be news on that front too.

Same. The official API is a joke. I've offered many times for MAL to use the API I help develop as an officially supported tool. It's quite full-featured too.

I'd love to at least get an update on that. Anything that comes from MAL. Even if it is "You are never getting a new API". We've been waiting since last year (Xinil told in his reddit AMA the new API would come by the end of 2015) and I haven't seen any word on that topic since.

Aug 25, 2016 3:20 AM

#118

Kineta

Lead Admin

Faerie Queen

Offline

Aug 2007

6262

LordHighCaptain said:
Contrary to the above, http://myanimelist.net/malappinfo.php?status=all&type=anime&u=lordhighcaptain redirects to https.

As stated somewhere else in this thread, this in an older version of the API. It now supports HTTP as well. Thank you for letting us know.

Malarkey said:
if this is why my list is broken, kms

Your list doesn't seem to be broken to me. Are you still having issues?

Hshr said:
nice, can your next project be making a fully featured RESTful API please?

TommasoScalici said:
By the way, a little OT: any plans about giving a "refresh" to the API too? It's really old, somewhat broken in some cases, etc.

IATGOF said:
I'd love to at least get an update on that.

We would really like to have the API overhauled and are fully aware there are many problems with it. Unfortunately, this is not something we can prioritise immediately, as we are still trying to improve site/mobile performance and functionality after years of neglect from our previous owners. This not only includes the new features you've seen; the backend of the site is still being reworked. Please understand that the site needs to be closer to fully functioning before we can focus on the API.

I've heard from many developers how painful our API is and I know many applications need to scrape data from the site to get all the information they require. Your frustration is warranted and fully understood. It's not that we aren't thrilled by all the apps users have written to work with MAL, or that we aren't sympathetic of your annoyance. There is just so much that needs to be done still, we need to prioritise other things if we want the site to continue receiving consistent, dedicated development.

motoko said:
BTW, my public offer of API assistance to MAL still stands. I'd be happy to provide code and help to get a proper API running so we don't have a bunch of third-party solutions breaking in wild ways.

Thank you for your offer, motoko. When we are able to prioritise an API overhaul, we will definitely get in contact with you and other 3rd party developers for input and feedback.

Speaking of which, I should probably start collecting a new list of developers. My old list is a bit outdated...

3rd party application developers, please add your information here to receive updates/information from us, when relevant.

Join MAL's Mod Team!　✧　
Guidelines & FAQ　✧　

Watch Cool Doji Danshi~　✧　

Aug 25, 2016 3:32 AM

#119

TommasoScalici

Offline

Jan 2014

3rd party application developers, please add your information here to receive updates/information from us, when relevant.[/quote]

Thanks for the answer and the added informations, I'll follow up to receive the latest news on the topic.

motoko said:

I'd be happy to provide code and help to get a proper API running so we don't have a bunch of third-party solutions breaking in wild ways.

Also, I strongly agree with this and I'm available too to eventually share some code or give help for the API. When speaking of API, standardization is important to avoid multiple ways to access the same resources or doing the same things and create a mess.

I developed a MyAnimeList App for Windows 10!
Check it out if you're interested. :)

Aug 25, 2016 4:34 AM

#120

Ruiko-chan

Offline

Feb 2016

No problems with https!

Aug 25, 2016 5:05 AM

#121

IATGOF

Offline

May 2010

243

Kineta said:
Please understand that the site needs to be closer to fully functioning before we can focus on the API.

I can absolutely understand that. All I'm asking is more transparency on what is the current priority on the API, and a rough estimate on when we might get an update so we can plan accordingly.

I've been waiting for the API to get updated to make a big overhaul of iMAL (which is very outdated currently) but now that I know it's not coming anytime soon I'll go ahead and switch to the unofficial API for now.

Aug 25, 2016 5:55 AM

#122

KurosoraRyuga

Offline

Aug 2015

406

The next big step should be having a fully functional mobile app

Aug 25, 2016 5:19 PM

#123

Catalyze

Towel Attendant

Offline

Dec 2014

1356

Thanks MAL!!
I appreciate the effort for security purposes. I noticed that my anime and manga lists were a bit altered recently (last few days). I had buttons that were non functional and some fonts were unusual. I went to the announcement page and found this topic. I read about SSL changes and went into my lists and just added an "s" to my main host. All nice again with just a single "s"......good stuff.

Aug 25, 2016 7:29 PM

#124

LordHighCaptain

Offline

Mar 2009

motoko said:

LordHighCaptain said:
Contrary to the above, http://myanimelist.net/malappinfo.php?status=all&type=anime&u=lordhighcaptain redirects to https.

I believe malappinfo.php was deprecated in 2009 with a replacement "soon". Not surprised that it would be overlooked (or that MAL would find some way to cause issues).

LordHighCaptain said:
This breaks my site since mono does not have any root certificates installed by default.

Unfortunately I was on mono 3.2.8 and cert-sync isn't until 3.12. mozroots, the old certificate import tool, doesn't work anymore due to some change on Mozilla's end. You can pass it a file that contains certificates, but no file I tried would work, including your link. I ended up upgrading to the latest mono from the Xamarin repo instead of using the Debian repo and getting the root certs installed that way.

@Kineta / @Xinil: Will the http->https redirects remain indefinitely? I assume so, so that links across the web aren't broken, but just checking if there's any rush to update my app's requests and links to https or if I can just let the redirects happen for a while.

Aug 26, 2016 12:21 PM

#125

Serieskiller

Offline

Oct 2011

Nice. And it only took you about a year to implement something that could have been done within 10 minutes!

Aug 26, 2016 11:09 PM

#126

GreedyChip

Offline

Mar 2016

108

Check you're signature make sure you're images and gif have a https link.

Aug 26, 2016 11:12 PM

#127

GreedyChip

Offline

Mar 2016

108

Catalyze said:
Thanks MAL!!
I appreciate the effort for security purposes. I noticed that my anime and manga lists were a bit altered recently (last few days). I had buttons that were non functional and some fonts were unusual. I went to the announcement page and found this topic. I read about SSL changes and went into my lists and just added an "s" to my main host. All nice again with just a single "s"......good stuff.

change http://i.imgur.com/OCmi51I.png to https://i.imgur.com/OCmi51I.png in you're signature.

Aug 26, 2016 11:16 PM

#128

motoko

Offline

Mar 2012

158

Serieskiller said:
Nice. And it only took you about a year to implement something that could have been done within 10 minutes!

Well, they have the CDN, which probably needed some planning. So, maybe more like a week, or a month if we want to be generous.

Developer, sysadmin, and anime addict.
Have an Android smartphone? Try Atarashii!

Aug 27, 2016 4:32 AM

#129

Lopardy

Offline

Jun 2014

Thanks! That's good news!

Aug 27, 2016 8:33 AM

#130

Crimson

Offline

Jul 2016

777

This apparently unblocked some of the entries that were blocked in my country for no reason. Thanks!

‏‏‎ ‎

「‏‏‎ artist‏‏‎ 」

「‏‏‎ don't forget to wear your‏‏‎ mask‏‏‎ 」

「‏‏‎

‏‏‎ 」

Aug 27, 2016 8:35 AM

#131

_MelodyTheeGirl_

Offline

Aug 2016

Can you add sailor moon Crystal to the anime list;)

Aug 27, 2016 9:37 AM

#132

tuankiet65

Offline

Aug 2014

It's time you did this. However even with this Chrome still refuses to show the green pad lock because most of the images in signatures are still loaded via HTTP. Not really sure how could we solve this though.

Aug 27, 2016 12:57 PM

#133

nomad01290

Offline

Jun 2016

Hmm, I have no ice what this means ;-p. But Good job anyways. ;-)

Aug 27, 2016 6:27 PM

#134

blaseog

Offline

Aug 2015

335

I just found out, good job MAL!

Aug 27, 2016 6:44 PM

#135

dante119

Offline

Dec 2008

omg there was no ssl
good thing i didn't use this password for anything else lololol

Aug 27, 2016 9:18 PM

#136

removed-user

Offline

Jul 2018

564612

Mixed Content: The page at 'https://myanimelist.net/forum/?topicid=1543851&show=100' was loaded over HTTPS, but requested an insecure image 'http://hikaritemple.com/sig/aposig.php'. This content should also be served over HTTPS.

Straight from the google chrome developer console. Having mixed content weaks your security and basicly just marks the page as insecure since http request can be used to attack an user. Having images not encrypted to spare yourselves bandwidth is a bad excuse in my opinion. even other websites don't have mixed content, but then again it seems to be no problem to encrypt the background images for the new mal pages.

Aug 28, 2016 7:33 AM

#137

FireHeart

Offline

Mar 2011

2731

Finally! Good job!

Aug 28, 2016 5:40 PM

#138

FrozenRaider

Offline

May 2015

5873

Hallelujah, praise the Lord! :)

"The future is always blank. Only your willpower can leave footsteps there."

"Ruling over death means ruling over life. Death is the climax of life. To have the best death, you must honor life."

Aug 28, 2016 6:56 PM

#139

Malarkey

Offline

May 2015

2588

Kineta said:

Malarkey said:
if this is why my list is broken, kms

Your list doesn't seem to be broken to me. Are you still having issues?

I was using the old list design before but have now switched over

I didnt have the css stored (I was using the translucent one deividas made) but I think Ill just stick with the new design for now

Freddy Nicholas said:
have control, be yourself, god is dead

Aug 29, 2016 12:09 AM

#140

howveryclever

Offline

Apr 2013

Awwww yeahhh :D

Xinil said:

Why doesn't the "secured" symbol appear on profile/forum pages? This is due to mixed content on the pages (images in the About Me / posts which are from non-HTTPS sources). We decided it would be unnecessarily restrictive to require all images embedded by users to come from HTTPS sources.

I don't think it's unnecessarily restrictive, given that there are quite a few image hosting services that serve their images over HTTPS (Imgur is one that comes to mind). And really, if your goal is to make browsing more secure on MAL, not having mixed content should be a given (even with the minor inconvenience of finding an SSL image hoster).

Aug 29, 2016 3:06 PM

#141

DJackerick

Offline

Sep 2008

you should make mandatory the use of images in https servers as well simply banning http sources, otherwise, you'll never stop asking your users to use secure hostings, many of them could be inactive, then active users will just have to migrate their images, that will make your site itself more secure.

BTW, check your sourcecode:

As example

<html xmlns:og="http://ogp.me/ns#" xmlns:fb="http://www.facebook.com/2008/fbml">

<div class="breadcrumb " itemscope itemtype="http://schema.org/BreadcrumbList">

<a data-ga-network="facebook" data-ga-screen="Share Button Location: common" class="js-share-button-popup js-share-button-tracking sprite-icon-social-small icon-social-small icon-facebook-small" target="_blank" href="http://www.facebook.com/share.php?u=https%3A%2F%2Fmyanimelist.net%2Fforum%2F%3Ftopicid%3D1543851"></a>

twitter, reddit, tumblr ...

DJackerickAug 29, 2016 3:13 PM

Aug 30, 2016 12:03 AM

#142

AlexNovakRamdass

Offline

Jul 2016

Hey thats great

Aug 31, 2016 1:56 PM

#143

removed-user

Offline

Jul 2018

564612

About time lol

Sep 6, 2016 4:57 PM

#144

Feniksrises

Offline

Dec 2014

780

Zeando said:

AllenVonStein said:

thnx for info but lol why would someone hack ur profile , what precious info he gonna get (nothing).

u don't buy nothing from mal.

yep, on most sites implementing it it's not needed (but people are paranoid and want to feel secure, but don't tell them)
expecially since it's about having secure connections, it's not even about hacking profiles, but about what you are sending/receiving to the site

what are you sending to the site?
-logins
-forum posts
-list edits
-recommendations/reviews
...and other stuff likely
where most of them are publicly visible anyway once they are received by the server (login and settings excluded)

...yes, the most sensible information is maybe the login, or the mail used(once one gets in), but even that, doubt anyone is keeping their bank id into their profile notes...
i don't think it's to prevent theft of informations(since there aren't any of value), but at most theft of accounts (social medias are sensible to thefts of identity, and since mal is 'socializing' itself..)

oh right, there is also the facebook/google/twitter login integration, eavesdropping those means getting two accounts violated at once, oh the progress (mmm, but those should be already under secure connection protocols, so it's not even that)

I signed up to MAL with an email account that I want to keep clean. Already have Gmail accounts filled with spam. When hacking a site like this emails and passwords can be a real treasure trove.

Sep 6, 2016 5:01 PM

#145

Feniksrises

Offline

Dec 2014

780

Aura_ said:

One side effect of this new feature is we will, unfortunately, no longer be able to provide our Daisuki videos for streaming. While we have had a great partnership, their service is not compatible with HTTPS. We hope to see their videos back in the future.

Not supporting HTTPS for video in 2016, really?

What if I told you some sites still rely on Adobe Flash?

See All Discussions

» [Challenge] You Should Read This Manga 2024 ( 1 2 3 4 5 ) Kineta - Feb 23	205	by stobagen »» 1 hour ago
» Try MAL's New Mobile Site! ( 1 2 3 4 5 ... Last Page ) Xinil - Feb 15, 2015	422	by Hayukoo »» Today, 8:30 AM
» Planned 5hr Maintenance, Thursday April 25 @ 1am-6am PT Kineta - Yesterday	0	by Kineta »» Yesterday, 8:10 PM
» New Site Update: Peak Anime 🗻 ( 1 2 3 4 5 ) Kineta - Mar 31	213	by Lancelot73 »» Apr 21, 4:28 AM
» Heavenly Easter Delusion: Devil and Dolce ( 1 2 3 4 5 ... Last Page ) Kineta - Mar 27	3332	by Terra_strong »» Apr 17, 8:26 PM

[Update Aug 25] MAL Gets Secured (SSL)!

More topics from this board

» [Challenge] You Should Read This Manga 2024 ( 1 2 3 4 5 )

» Try MAL's New Mobile Site! ( 1 2 3 4 5 ... Last Page )

» Planned 5hr Maintenance, Thursday April 25 @ 1am-6am PT

» New Site Update: Peak Anime 🗻 ( 1 2 3 4 5 )

» Heavenly Easter Delusion: Devil and Dolce ( 1 2 3 4 5 ... Last Page )

MoreTop Anime

MoreTop Airing Anime

MoreMost Popular Characters