[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130815011147.096b4c1e.reed@reedloden.com>
Date: Thu, 15 Aug 2013 01:11:47 -0700
From: Reed Loden <reed@...dloden.com>
To: oss-security@...ts.openwall.com
Cc: Kurt Seifried <kseifried@...hat.com>
Subject: Re: rubygems insecure download (and other problems)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Wed, 14 Aug 2013 14:59:12 -0600
Kurt Seifried <kseifried@...hat.com> wrote:
> Problem #2:
> it redirects to production.cf.rubygems.org which is on cloudfront so
> has certificate mismatch, so either users have to accept insecurity,
> or... well there is no second choice =(.
>
> https://www.ssllabs.com/ssltest/analyze.html?d=production.cf.rubygems.org
It only does that if you use http://. If you use https://rubygems.org,
it goes through S3 directly
(https://s3.amazonaws.com/production.s3.rubygems.org/)
See this code:
https://github.com/rubygems/rubygems-aws/blob/master/chef/site-cookbooks/rubygems/templates/default/nginx_balancer.conf.erb
I do wish they would fix their cipher suite choices, though. :/
~reed
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAlIMjUMACgkQa6IiJvPDPVr9pACfcbDy0A0NtHZbXfLgkzahGPsU
+tMAn0g7YtbhyA7e7sGuFNudJNkKlae5
=J+1x
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
