On 2019-03-12 08:58, Archie Cobbs wrote: > On Tue, Mar 12, 2019 at 9:32 AM Brian Inglis wrote: >>> OTOH, if you download the file over HTTPS.. then your client supports >>> SSL. Which is exactly what I'm saying should be mandatory. >> Forcing TLS means blocking anyone who for any reason can not use TLS: this >> is a >> performance and support burden compared to allowing both HTTP:80 and >> HTTPS:443. > OK. Personally I have trouble believing any such person exists. That > is, a person who has access to an HTTP client, but not an HTTPS > client, for the one-time operation of downloading setup.exe. What are > they using, a TRS-80?
I never said it was a person nor that they did not have access to a TLS client. I said they could not use a TLS client, which could be because of platform deficiencies, corporate policies, proxies, firewalls, security products. Systems or images older than a year may need the new root CA installed - some enterprises are very selective about including support for anything in their images - and users may not have root CA store access. I have systems which can support only original SSL not TLS - good luck using HTTPS to or from them, without using equally old software or libraries! > Anyway no worries, I'm giving up on this issue. Too much inertia around here. Perhaps just a desire not to break users access based om a wider understanding and experience of the variety across the complete ecosystem in which the projects are used, not just folks using modern desktop GUIs with no system or network access policies or restrictions. -- Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada This email may be disturbing to some readers as it contains too much technical detail. Reader discretion is advised. -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
