Oh awesome, I backed both of your courses.

Wish I could say that I have had enough time to go through them both...

Isn't the website payment system vulnerable to MITM without without using https?

Simple Goods (our provider) does use https via an iframe, so it's secure although not best practice - that said, we'll be moving to Stripe soon!

Technically, no. The payment happens within an iframe secured with https: https://www.simplegoods.co/embed/PKGTEISN

The issue with it however is that the initial page is delivered over an insecure connection, which allows any part of it to be modified in the usual MITM style. Nothing prevents an attacker from changing the link that is served to the client with something else that looks like that payment system and functions the same, but logs the payment information. There's a reason Firefox now disallows mixed HTTP/HTTPS content by default[0]

[0] - https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-bloc...

In other words: yes, it's vulnerable to SSL stripping.

If the main page is insecure, then everything is insecure.

My work VPN blocks this as porn. Ha!

do you work at a ruby shop?

Har har. I work in finance.

Oof, good to know... Any other false positives you've had so I can maybe figure out why?

Edit: Never mind, I think your censorware might just have a more inventive sexual imagination than I do when it comes to domain names...

Not sure it would be related, but python.com used to be a startling high-res extremely NSFW spread that you really didn't want to accidentally visit in a public setting when you really wanted python.org...

(They are now 'no longer accepting new affiliates' though, and the pictures are gone.)

This was also blocked at work:

>http://blogs.sfweekly.com/foodie/2013/12/amazonfresh_has_lau...

But the main site (http://www.sfweekly.com/) and the blog site (http://blogs.sfweekly.com/) aren't blocked. I'm going to guess my work filter is just screwy.

None that I'm aware of.