GWJ bugs, feature requests, and updates

Amoebic wrote:

Merphle: what browser type and devices are you using when you get these errors?

Firefox on Win 10.

All: aware of password warning issue. Currently looking into it. If you received that message, please update with a new password.

The "new messages in favorites" indicator stopped working for me a few days ago. I checked many pages of favorites but nothing new, so I used the "mark read" link and that worked. Then it happened again today.

I think it's not cookies because it happened across multiple browsers. Maybe I have a phantom favorite that isn't spearing in the message list? I hope I don't have to clear out my favorites list.

Hello!
Doogiemac is currently in the process of getting us set up for a server migration. Once that's completed, we'll be running a much-needed drupal update once on the new server. That update may resolve some issues, or make resolving them easier, at least. All that may happen in a month or so, and I appreciate you patience while that gets settled.

Hi everyone, I just joined the forum a couple of days ago and it seems like a pretty nice place. I wondered if anyone might be able to help me with a few things I'm looking for?

Does anyone know if there's a quick way of checking new posts on the forum? Like rather than go to each thread to see if anyone has posted after me, just one page with all new posts or replies on?

Also, forum navigation. Is there a way aside from the links at the bottom of each forum page of navigating back to the forum home? Usually in phpBB they'd be at the top and easy to reach without having to scroll all the way to the bottom of the page but I'm not sure what forum software this one is built in so didn't know if it's a feature that's just not available. I'm accessing the forum via an Android phone, if that makes a difference.

Finally, is there a way of searching the forum?

Thank you!

Search on a phone is tough to access. Go to the Menu bars, press and hold on "MORE", swipe back (use your back button, etc.) and the "Search GWJ" thing should be there.

garion333 wrote:

Search on a phone is tough to access. Go to the Menu bars, press and hold on "MORE", swipe back (use your back button, etc.) and the "Search GWJ" thing should be there.

Ah perfect, thanks!

Honestly, most of just use Google with the site keyword.

Recent activity page shows threads that you have posted in with new posts. Here is yours.

Alex79uk wrote:

Hi everyone, I just joined the forum a couple of days ago and it seems like a pretty nice place. I wondered if anyone might be able to help me with a few things I'm looking for?

Does anyone know if there's a quick way of checking new posts on the forum? Like rather than go to each thread to see if anyone has posted after me, just one page with all new posts or replies on?

Try this: https://www.gamerswithjobs.com/user/...

Each user has a "favorites" page where it lists threads you've "favorited", sorted by most recent post. It should tell you if there are new posts and how many. You can favorite threads by clicking the "Add to Favorites" link at the top of each thread page.

Awesome, thanks all

I don't know how it looks on a phone, but keep in mind that the main page on the desktop version tells you how many 'new' posts there are in each thread.

This is ALL posts: the forum keeps track of which topics you've read. If you see New for a thread, there's more since the last time you read it. If you want threads that you have posted in, then your user page or the favorites page, if you use that, will help.

I find favorites useful, but have never gotten much good out of the user posts page.

If a thread has NO replies, then it won't show anything New, even if you haven't read it. I sometimes miss posts that way, because I focus pretty hard on the new posts column.

BBCode quirks. Examples are using a single open/close bold tag across both lines, but I observed it happening with strikethrough tags as well.


Example 1 (vanilla text block):

This is bold

Why is this not bold?


Example 2 (text in a spoiler block):
Spoiler:

This is bold

Why is this not bold?


Example 3 (text in an unattributed quote block):
This is bold

This is also bold, but spacing between lines was lost


Example 4 (text in an attributed quote block):
nobody in particular wrote:

This is bold

Why is this not bold?


I keep seeing the same bug, but from a slightly different angle. Quotes often suppress the first blank line in a quote. They may mess up codes, too, but I've found that simple newlines get damaged. I often have to add in a   code plus a newline, after the first paragraph in a quote, to get the proper spacing.

In other words, I'll have to write a quote like this:

[quote]This is the first paragraph of the quote.   This is the second paragraph of the quote.[/quote]

If I don't do that, then the two paragraphs appear immediately after one another with no line in between.

IIRC, with multiparagraph quotes, this happens only on the first newline. But if I use the nbsp trick. then the next, untouched blank line becomes the 'first', and gets swallowed. Thus, I end up having to put the code after every paragraph in a quote to stop the first blank line from disappearing.... which one is first keeps moving down as I add codes, so I have to do all of them.

It's interesting that the behavior changes based on whether or not the quote is attributed. That might be the ultimate source of the bug.

Yep. Don't get me wrong, I'm not complaining about this - just documenting some example test cases that I ran into while editing a post earlier today, in the hopes that it might someday help one of our exceedingly talented website maintainers.

Yeah, I've never complained about it because it didn't bother me enough to even think of doing so. I just added in my nbsp codes and got on with things. But, since you were mentioning it, I figured I'd add what I'd seen.

Malor wrote:

Yeah, I've never complained about it because it didn't bother me enough to even think of doing so. I just added in my nbsp codes and got on with things. But, since you were mentioning it, I figured I'd add what I'd seen.

My workaround is to put two linebreaks (hit enter key twice) before the first line of text in the quote. I.e.,

[quote] This is the first paragraph of the quote. This is the second paragraph of the quote.[/quote]

Which then appears like this:

This is the first paragraph of the quote.

This is the second paragraph of the quote.

Well that seems a lot simpler than inserting the nbsp codes, doesn't it!

Yeah, now I feel stupid.

Just now, at 1:04 AM Pacific, I was getting TLS errors, NO_CYPHER_OVERLAP. This Firefox is configured pretty tightly, so you probably messed up your cipher string to eliminate the newest protocols. (or, perhaps, ALL of them, if you're tinkering.)

Figured I'd say something now, quickly, since I can get through now, just in case it comes back.

Thanks for the heads-up on that, Malor. I did some research and it looks like it can take Cloudflare some time to recognize and fully deploy to it's edges origin certificate changes. I'll continue to monitor this.

On this particular connection, I'm TLS 1.3, using TLS_AES_128_GCM_SHA256, probably the most common option for 1.3. I have a personal preference for TLS_CHACHA20_POLY1305_SHA256, but you may not have that option if you're running Cloudflare.

Note that for most Intel-based servers, this is a little less efficient; the dedicated AES instructions will run faster than CHACHA20. I just prefer ChaCha out of an abundance of caution: now that we know that the NSA has been actively trying to corrupt civilian encryption, ChaCha/Poly1305 is one of the only ciphers known to be developed entirely independently, and it doesn't use any "trust me" numbers at all, unlike all the NIST curves. (which are probably not trustworthy.)

It's not accelerated, but it's amazingly efficient, and in the absence of AES acceleration, it will run much faster. It's about 2/3 as fast as accelerated AES, just using ordinary, non-special opcodes. It's also a constant-time algorithm, so it's hard to get the code to accidentally leak key info. In the era of silicon security holes, this may not matter very much, but I'm a fan of doing everything well that you can.

I just got that error again, about five times in a row. Something is amiss in the Cloudflare service, I believe.

So, TLS 1.3 should be supported, but the minimum version I've configured Cloudflare to *require* is 1.0. Do you think that could be causing some of what you're seeing?

I've been poking at Cloudflare a little when the problem crops up, and it seems to happen about once a day. Unfortunately, the only tool I have right now that shows me the list of ciphers offered is nmap, with the --enum-ssl-ciphers script. It makes a zillion connections, each with a different cipher, to see if it's supported.

This is a terrible way to test; I need a quick snapshot. By the time that script runs through all its options, the problem goes away. Its output is basically meaningless.

I have this browser set to accept 1.2 and 1.3 only, but I don't think I've otherwise restricted ciphers. (I might have disabled RC4, but that would also happen in the 1.2 restriction, so I don't think it's meaningful.) I'll have to see if I can find a different tool that will connect to a remote site and just dump a nice English text of all the ciphers on offer.

However, the digging with that nmap script allowed me to spot some bad ciphers on my mail server, so it wasn't wasted time.

edit: ooh, hey, one possible problem is that Cloudflare is using an ECC cert. I wonder if that might be related?

I'm still seeing the NO_CYPHER_OVERLAP message at least once a day, and it usually takes eight or ten reloads to get past it.

One thing I can try is raising the minimum TLS version required for visits to the site, but I'm reluctant to do so as it could block access to an unknown number of users not running modern browsers. What's confusing to me is that you're not *always* seeing the problem. This could be due to hitting different Cloudflare edge servers, which may be responding in different ways. That's frustrating, though, as they should all be consistent.

Malor, can you confirm if this issue only started happening after our server move on March 20?

I posted about it the very first time I saw it, and that was on 3/21, so I suspect it's somehow related to the server move. It could be a bad Cloudflare server, as you say.

I thought I had this Firefox locked down to only do TLS v1.2, but I just dug through all my settings, and this particular profile doesn't seem to have any changes in the encryption settings over the base default for the browser. So I'm really confused about why I'm the only one seeing the problem, and only occasionally.

Is anyone else with Firefox getting NO_CYPHER_OVERLAP errors? Intermittently?

Of course, if they're getting them constantly, then they can't report it.....

I use Firefox exclusively (except for mobile) and I haven't seen it but it sounds very transient.

Firefox 74 on Win 10 - no issues.
Firefox 23 on iOS - no issues.

Any way to trace which Cloudflare edge server you're hitting?