John-Mark Gurney
2017-Dec-10 17:32 UTC
http subversion URLs should be discontinued in favor of https URLs
Igor Mozolevsky wrote this message on Wed, Dec 06, 2017 at 15:04 +0000:> On 5 December 2017 at 23:18, RW via freebsd-security < > freebsd-security at freebsd.org> wrote: > > > On Tue, 5 Dec 2017 14:08:49 -0800 > > Gordon Tetlow wrote: > > > > > > > Using this as a reason to not move to HTTPS is a fallacy. We should do > > > everything we can to help our end-users get FreeBSD in the most secure > > > way. > > > > I think it's more a question of whether all users should be forced onto > > https even if it might prevent some users from getting security updates. > > If updates are signed, then I don't see what can be gained by using > relatively expensive HTTPS over HTTP.The discussion has been for svn updates over http, not for freebsd-update updates which are independantly signed and verified.. There is currently no signatures provided via SVN to validate any source received via http. -- John-Mark Gurney Voice: +1 415 225 5579 "All that I will do, has been done, All that I have, has not."
Igor Mozolevsky
2017-Dec-10 17:39 UTC
http subversion URLs should be discontinued in favor of https URLs
On 10 December 2017 at 17:32, John-Mark Gurney <jmg at funkthat.com> wrote: <snip>> > The discussion has been for svn updates over http, not for freebsd-update > updates which are independantly signed and verified.. There is currently > no signatures provided via SVN to validate any source received via http. > >There has been no instance of in-transit compromise reported since SVN was introduced. Even when the back-end was compromised, there was not detectable compromise of the codebase [1]. So even if the codebase was compromised, unless people *really knew* what they were doing, HTTPS would seed a false sense of security. There is a number of organisation that your computer is told to trust by default who have the know-how and capability to mount MITM without one even knowing unless that one were to manually verify CAs used for host certs, again, HTTPS doesn't buy anything in that regards. 1. https://www.freebsd.org/news/2012-compromise.html -- Igor M.