Igor Mozolevsky
2017-Dec-06 15:04 UTC
http subversion URLs should be discontinued in favor of https URLs
On 5 December 2017 at 23:18, RW via freebsd-security < freebsd-security at freebsd.org> wrote:> On Tue, 5 Dec 2017 14:08:49 -0800 > Gordon Tetlow wrote: > > > > Using this as a reason to not move to HTTPS is a fallacy. We should do > > everything we can to help our end-users get FreeBSD in the most secure > > way. > > I think it's more a question of whether all users should be forced onto > https even if it might prevent some users from getting security updates.If updates are signed, then I don't see what can be gained by using relatively expensive HTTPS over HTTP. People screaming for HTTPS without justifying a specific threat model (cf. a generic "MITM"-bogeyman), don't understand HTTPS nor general security (to paraphrase the famous phrase). -- Igor M.
John-Mark Gurney
2017-Dec-10 17:32 UTC
http subversion URLs should be discontinued in favor of https URLs
Igor Mozolevsky wrote this message on Wed, Dec 06, 2017 at 15:04 +0000:> On 5 December 2017 at 23:18, RW via freebsd-security < > freebsd-security at freebsd.org> wrote: > > > On Tue, 5 Dec 2017 14:08:49 -0800 > > Gordon Tetlow wrote: > > > > > > > Using this as a reason to not move to HTTPS is a fallacy. We should do > > > everything we can to help our end-users get FreeBSD in the most secure > > > way. > > > > I think it's more a question of whether all users should be forced onto > > https even if it might prevent some users from getting security updates. > > If updates are signed, then I don't see what can be gained by using > relatively expensive HTTPS over HTTP.The discussion has been for svn updates over http, not for freebsd-update updates which are independantly signed and verified.. There is currently no signatures provided via SVN to validate any source received via http. -- John-Mark Gurney Voice: +1 415 225 5579 "All that I will do, has been done, All that I have, has not."