[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130815133457.GE3498@yuggoth.org>
Date: Thu, 15 Aug 2013 13:34:57 +0000
From: Jeremy Stanley <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: Re: HTTPS
On 2013-08-15 14:31:19 +0400 (+0400), gremlin@...mlin.ru wrote:
[...]
> Unlike SSH, the HTTPS clients (which usually are the browsers) do
> not cache the visited servers' certificates, fully relying on
> issuing CA's honesty. This introduces a risk of false sence of
> security.
>
> Hmmmm... It seems that keeping self-signed certificates is even
> more safe than relying on "trusted" CAs...
[...]
Dragging this back onto the original topic, hopefully, the above
concerns are far less relevant for a tool focused on downloading
packages from a single site. The gem utility could absolutely pin
its validation expectations to a single signing authority or even to
a single server certificate (and make it a configurable list to
support private package repositories and mirrors where desired). The
transport security implications for a system with basically one
distribution endpoint offer significantly different solutions than a
many-to-many association like Web browsing.
--
{ PGP( 48F9961143495829 ); FINGER( fungi@...ulhu.yuggoth.org );
WWW( http://fungi.yuggoth.org/ ); IRC( fungi@....yuggoth.org#ccl );
WHOIS( STANL3-ARIN ); MUD( kinrui@...arsis.mudpy.org:6669 ); }
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
