freebsd security - Dec 2017 - http subversion URLs should be discontinued in favor of https URLs

Michelle Sullivan wrote this message on Mon, Dec 11, 2017 at 09:41
+1100:
> Yuri wrote:
> > On 12/10/17 10:15, Igor Mozolevsky wrote:
> >> They are not "hypothetical characters," they are
invented characters
> >> that
> >> are used in a threat model. But that's reframing the problem-
a
> >> hypothetical threat model is very different to a real threat
model.
> >
> >
> > This is a very real threat model. There are a lot of malicious Tor 
> > exit node operators, and a lot of FreeBSD users update their system 
> > over subversion. The only thing that the Tor node operator needs to do
> > is to detect relevant requests and serve malware.
> >
> > How is this not real?
> 
> Sounds to me the proper solution is stop using Tor.
> 
> If you can't trust the network (wire) no matter what you do you
can't
> guarantee safety.
IMO, all security needs to be node-to-node.  It needs to be assumed
that the network is compromised.  Be it public wifi, tor, or malicious
actor rerouting traffic via BGP spoofing, node-to-node protection is
the answer to all of those.

Considering that China has redirected large segments of the inet traffic
through them, you can't even trust the inet back bone to be secure.  I
know I've never gotten notification from my ISP that my traffic may have
been compromised this way, and w/o notification, I cannot properly assess
what may have been compromised.

-- 
  John-Mark Gurney				Voice: +1 415 225 5579

     "All that I will do, has been done, All that I have, has not."

--------
In message <20171210225326.GK5901 at funkthat.com>, John-Mark Gurney
writes:
>IMO, all security needs to be node-to-node. 
There's nothing "IMO" about that.

The end-to-end principle became a bed-rock foundation of all rational
networking with "End to End Arguments in System Design" in 1981.

    http://web.mit.edu/Saltzer/www/publications/endtoend/endtoend.pdf

The only realistic way for the FreeBSD project to implement end-to-end
trust, is HTTPS with a self-signed cert, distributed and verified
using the projects PGP-trust-mesh and strong social network.

Anything else is just pretend-security today.

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
phk at FreeBSD.ORG         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.