From owner-freebsd-security@freebsd.org Sun Dec 10 22:53:28 2017 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 66FCDE9FF93 for ; Sun, 10 Dec 2017 22:53:28 +0000 (UTC) (envelope-from jmg@gold.funkthat.com) Received: from gold.funkthat.com (gate2.funkthat.com [208.87.223.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "gate2.funkthat.com", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id BCCFF66CF5 for ; Sun, 10 Dec 2017 22:53:27 +0000 (UTC) (envelope-from jmg@gold.funkthat.com) Received: from gold.funkthat.com (localhost [127.0.0.1]) by gold.funkthat.com (8.15.2/8.15.2) with ESMTPS id vBAMrQBP017824 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sun, 10 Dec 2017 14:53:26 -0800 (PST) (envelope-from jmg@gold.funkthat.com) Received: (from jmg@localhost) by gold.funkthat.com (8.15.2/8.15.2/Submit) id vBAMrQhh017822; Sun, 10 Dec 2017 14:53:26 -0800 (PST) (envelope-from jmg) Date: Sun, 10 Dec 2017 14:53:26 -0800 From: John-Mark Gurney To: Michelle Sullivan Cc: Yuri , Igor Mozolevsky , freebsd security , RW Subject: Re: http subversion URLs should be discontinued in favor of https URLs Message-ID: <20171210225326.GK5901@funkthat.com> Mail-Followup-To: Michelle Sullivan , Yuri , Igor Mozolevsky , freebsd security , RW References: <20171205231845.5028d01d@gumby.homeunix.com> <20171210173222.GF5901@funkthat.com> <5c810101-9092-7665-d623-275c15d4612b@rawbw.com> <19bd6d57-4fa6-24d4-6262-37e1487d7ed6@rawbw.com> <5A2DB80D.3020309@sorbs.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5A2DB80D.3020309@sorbs.net> X-Operating-System: FreeBSD 11.0-RELEASE-p7 amd64 X-PGP-Fingerprint: D87A 235F FB71 1F3F 55B7 ED9B D5FF 5A51 C0AC 3D65 X-Files: The truth is out there X-URL: https://www.funkthat.com/ X-Resume: https://www.funkthat.com/~jmg/resume.html X-TipJar: bitcoin:13Qmb6AeTgQecazTWph4XasEsP7nGRbAPE X-to-the-FBI-CIA-and-NSA: HI! HOW YA DOIN? can i haz chizburger? User-Agent: Mutt/1.6.1 (2016-04-27) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.4.3 (gold.funkthat.com [127.0.0.1]); Sun, 10 Dec 2017 14:53:26 -0800 (PST) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Dec 2017 22:53:28 -0000 Michelle Sullivan wrote this message on Mon, Dec 11, 2017 at 09:41 +1100: > Yuri wrote: > > On 12/10/17 10:15, Igor Mozolevsky wrote: > >> They are not "hypothetical characters," they are invented characters > >> that > >> are used in a threat model. But that's reframing the problem- a > >> hypothetical threat model is very different to a real threat model. > > > > > > This is a very real threat model. There are a lot of malicious Tor > > exit node operators, and a lot of FreeBSD users update their system > > over subversion. The only thing that the Tor node operator needs to do > > is to detect relevant requests and serve malware. > > > > How is this not real? > > Sounds to me the proper solution is stop using Tor. > > If you can't trust the network (wire) no matter what you do you can't > guarantee safety. IMO, all security needs to be node-to-node. It needs to be assumed that the network is compromised. Be it public wifi, tor, or malicious actor rerouting traffic via BGP spoofing, node-to-node protection is the answer to all of those. Considering that China has redirected large segments of the inet traffic through them, you can't even trust the inet back bone to be secure. I know I've never gotten notification from my ISP that my traffic may have been compromised this way, and w/o notification, I cannot properly assess what may have been compromised. -- John-Mark Gurney Voice: +1 415 225 5579 "All that I will do, has been done, All that I have, has not."