{"action":"created","issue":{"url":"https://api.github.com/repos/metamaps/metamaps_gen002/issues/445","labels_url":"https://api.github.com/repos/metamaps/metamaps_gen002/issues/445/labels{/name}","comments_url":"https://api.github.com/repos/metamaps/metamaps_gen002/issues/445/comments","events_url":"https://api.github.com/repos/metamaps/metamaps_gen002/issues/445/events","html_url":"https://github.com/metamaps/metamaps_gen002/issues/445","id":123157454,"number":445,"title":"Metacode icons not at an HTTPS url won't work if Metamaps is served over https","user":{"login":"devvmh","id":1393708,"avatar_url":"https://avatars.githubusercontent.com/u/1393708?v=3","gravatar_id":"","url":"https://api.github.com/users/devvmh","html_url":"https://github.com/devvmh","followers_url":"https://api.github.com/users/devvmh/followers","following_url":"https://api.github.com/users/devvmh/following{/other_user}","gists_url":"https://api.github.com/users/devvmh/gists{/gist_id}","starred_url":"https://api.github.com/users/devvmh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/devvmh/subscriptions","organizations_url":"https://api.github.com/users/devvmh/orgs","repos_url":"https://api.github.com/users/devvmh/repos","events_url":"https://api.github.com/users/devvmh/events{/privacy}","received_events_url":"https://api.github.com/users/devvmh/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/metamaps/metamaps_gen002/labels/ruby","name":"ruby","color":"f7c6c7"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/metamaps/metamaps_gen002/milestones/16","html_url":"https://github.com/metamaps/metamaps_gen002/milestones/Do%20next%20month","labels_url":"https://api.github.com/repos/metamaps/metamaps_gen002/milestones/16/labels","id":1382573,"number":16,"title":"Do next month","description":"","creator":{"login":"devvmh","id":1393708,"avatar_url":"https://avatars.githubusercontent.com/u/1393708?v=3","gravatar_id":"","url":"https://api.github.com/users/devvmh","html_url":"https://github.com/devvmh","followers_url":"https://api.github.com/users/devvmh/followers","following_url":"https://api.github.com/users/devvmh/following{/other_user}","gists_url":"https://api.github.com/users/devvmh/gists{/gist_id}","starred_url":"https://api.github.com/users/devvmh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/devvmh/subscriptions","organizations_url":"https://api.github.com/users/devvmh/orgs","repos_url":"https://api.github.com/users/devvmh/repos","events_url":"https://api.github.com/users/devvmh/events{/privacy}","received_events_url":"https://api.github.com/users/devvmh/received_events","type":"User","site_admin":false},"open_issues":24,"closed_issues":3,"state":"open","created_at":"2015-10-29T02:13:33Z","updated_at":"2015-12-20T12:55:51Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2015-12-20T12:31:35Z","updated_at":"2015-12-21T02:34:45Z","closed_at":null,"body":"Once we move to using https only, we'll have a UX issue.\r\n\r\nIf I want to create a new metacode set using images hosted at http://insecure.devinhoward.ca, which doesn't have SSL, I'll have a problem. I'll create the metacodes, and for the icon field I'll fill in a url like \"http://insecure.devinhoward.ca/cool-metacode.png\". But then Chrome and Opera and others will block that content, or worse, mark the entire page as insecure because there's an insecure image in the page for every page containing that metacode.\r\n\r\nSo possible solutions are:\r\n\r\n1. Only allow the icon field to take urls starting with https\r\n2. Change the field to an AWS file upload like user profile images\r\n3. Keep the field as a text field, but if it starts with http, use a script to download that image and then store it on AWS and serve it via HTTPS.\r\n\r\nHere are the problems I've noticed for each approach:\r\n\r\n1. This kind of sucks as as solution, because I might put https://insecure.devinhoward.ca/cool-metacode.png in the field, and then it won't be secure, so it'll create security errors.\r\n2. Perhaps we didn't do this in the past because of copyright issues? I'm not sure. This seems like the best solution to me.\r\n3. This is ambitious, lots of work, and still has problems. If a website starts out secure, but the certificate expires, we're screwed. I really wouldn't want to be tracking down these insecure images and fixing them later...\r\n\r\nAfter reflecting on these three options, I've convinced myself the only way is to do it all via AWS and serve it over HTTPS, because that's really the only reliable way I see to ensure all metacode icons are secure forever. Do others have thoughts?"},"comment":{"url":"https://api.github.com/repos/metamaps/metamaps_gen002/issues/comments/166181549","html_url":"https://github.com/metamaps/metamaps_gen002/issues/445#issuecomment-166181549","issue_url":"https://api.github.com/repos/metamaps/metamaps_gen002/issues/445","id":166181549,"user":{"login":"Connoropolous","id":1409121,"avatar_url":"https://avatars.githubusercontent.com/u/1409121?v=3","gravatar_id":"","url":"https://api.github.com/users/Connoropolous","html_url":"https://github.com/Connoropolous","followers_url":"https://api.github.com/users/Connoropolous/followers","following_url":"https://api.github.com/users/Connoropolous/following{/other_user}","gists_url":"https://api.github.com/users/Connoropolous/gists{/gist_id}","starred_url":"https://api.github.com/users/Connoropolous/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Connoropolous/subscriptions","organizations_url":"https://api.github.com/users/Connoropolous/orgs","repos_url":"https://api.github.com/users/Connoropolous/repos","events_url":"https://api.github.com/users/Connoropolous/events{/privacy}","received_events_url":"https://api.github.com/users/Connoropolous/received_events","type":"User","site_admin":false},"created_at":"2015-12-21T02:34:45Z","updated_at":"2015-12-21T02:34:45Z","body":"We shouldn't worry about staging really, we could just keep setting all the\nmetacodes to wildcard or whatever. There is actual content we'd prefer not\nto lose in staging. Not much of it, but a bit.\nOn Dec 20, 2015 9:21 PM, \"Devin Howard\" <notifications@github.com> wrote:\n\n> This will be fine for metamaps.cc, but it'll totally screw up the staging\n> database without a really complicated migration. I'll consider taking a\n> look at migrating, but how bad would it be to wipe out the staging database\n> and restart from fixtures?\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/metamaps/metamaps_gen002/issues/445#issuecomment-166179905>\n> .\n>\n"}}