Date: Sun, 10 Dec 2017 09:32:22 -0800 From: John-Mark Gurney <jmg@funkthat.com> To: Igor Mozolevsky <mozolevsky@gmail.com> Cc: RW <rwmaillists@googlemail.com>, freebsd security <freebsd-security@freebsd.org> Subject: Re: http subversion URLs should be discontinued in favor of https URLs Message-ID: <20171210173222.GF5901@funkthat.com> In-Reply-To: <CADWvR2gVn8H5h6LYB5ddwUHYwDtiLCuYndsXhJywi7Q9vNsYvw@mail.gmail.com> References: <97f76231-dace-10c4-cab2-08e5e0d792b5@rawbw.com> <5A2709F6.8030106@grosbein.net> <11532fe7-024d-ba14-0daf-b97282265ec6@rawbw.com> <8788fb0d-4ee9-968a-1e33-e3bd84ffb892@heuristicsystems.com.au> <20171205220849.GH9701@gmail.com> <20171205231845.5028d01d@gumby.homeunix.com> <CADWvR2gVn8H5h6LYB5ddwUHYwDtiLCuYndsXhJywi7Q9vNsYvw@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Igor Mozolevsky wrote this message on Wed, Dec 06, 2017 at 15:04 +0000:
> On 5 December 2017 at 23:18, RW via freebsd-security <
> freebsd-security@freebsd.org> wrote:
>
> > On Tue, 5 Dec 2017 14:08:49 -0800
> > Gordon Tetlow wrote:
> >
> >
> > > Using this as a reason to not move to HTTPS is a fallacy. We should do
> > > everything we can to help our end-users get FreeBSD in the most secure
> > > way.
> >
> > I think it's more a question of whether all users should be forced onto
> > https even if it might prevent some users from getting security updates.
>
> If updates are signed, then I don't see what can be gained by using
> relatively expensive HTTPS over HTTP.
The discussion has been for svn updates over http, not for freebsd-update
updates which are independantly signed and verified.. There is currently
no signatures provided via SVN to validate any source received via http.
--
John-Mark Gurney Voice: +1 415 225 5579
"All that I will do, has been done, All that I have, has not."
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20171210173222.GF5901>