Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130815133457.GE3498@yuggoth.org>
Date: Thu, 15 Aug 2013 13:34:57 +0000
From: Jeremy Stanley <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: Re: HTTPS

On 2013-08-15 14:31:19 +0400 (+0400), gremlin@...mlin.ru wrote:
[...]
> Unlike SSH, the HTTPS clients (which usually are the browsers) do
> not cache the visited servers' certificates, fully relying on
> issuing CA's honesty. This introduces a risk of false sence of
> security.
> 
> Hmmmm... It seems that keeping self-signed certificates is even
> more safe than relying on "trusted" CAs...
[...]

Dragging this back onto the original topic, hopefully, the above
concerns are far less relevant for a tool focused on downloading
packages from a single site. The gem utility could absolutely pin
its validation expectations to a single signing authority or even to
a single server certificate (and make it a configurable list to
support private package repositories and mirrors where desired). The
transport security implications for a system with basically one
distribution endpoint offer significantly different solutions than a
many-to-many association like Web browsing.
-- 
{ PGP( 48F9961143495829 ); FINGER( fungi@...ulhu.yuggoth.org );
WWW( http://fungi.yuggoth.org/ ); IRC( fungi@....yuggoth.org#ccl );
WHOIS( STANL3-ARIN ); MUD( kinrui@...arsis.mudpy.org:6669 ); }

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.