On 5 December 2017 at 23:18, RW via freebsd-security <
freebsd-security@freebsd.org> wrote:
> On Tue, 5 Dec 2017 14:08:49 -0800
> Gordon Tetlow wrote:
>
>
> > Using this as a reason to not move to HTTPS is a fallacy. We should do
> > everything we can to help our end-users get FreeBSD in the most
On 12/6/2017 08:17, Cy Schubert wrote:
>
>> It can be illusory. My last job was as Sec Mgr for a large bank. They
>> disabled cert checking on client devices, placed a wildcard cert at the
>> internet boundary and captured all https unencrypted. An alternative
>> approach to advocate is dnssec.
No worries, telnet and ftp are in my sights.
---
Sent using a tiny phone keyboard.
Apologies for any typos and autocorrect.
This old phone only supports top post. Apologies.
Cy Schubert
or
The need of the many outweighs the greed of the few.
---
-Original Message-
From: Steve Clement
S
On 06.12.2017 05:08, Gordon Tetlow wrote:
> Using this as a reason to not move to HTTPS is a fallacy. We should do
> everything we can to help our end-users get FreeBSD in the most secure
> way.
Please do not mix opportunity with enforcement.
___
free
On Tue, Dec 05, 2017 at 01:13:25PM -0800, Yuri wrote:
> On 12/05/17 13:04, Eugene Grosbein wrote:
> > It is illusion that https is more secure than unencrypted http in a sense
> > of MITM
> > just because of encryption, it is not.
>
>
> It *is* more secure.
https don't work frequent than http
It is illusion
As a security person you do have responsibilities
Lets calm down, guys. Anyone can claim "I'm skilled security officer".
But true professional will define the risk to mitigate *first*.
We can discuss possible solutions *then*.
Flamewars "https will save our souls" v.s. "https i
* On Wed, Dec 06, 2017 at 08:55:00AM +1100, Dewayne Geraghty
wrote:
> On 6/12/2017 8:13 AM, Yuri wrote:
> > On 12/05/17 13:04, Eugene Grosbein wrote:
> >> It is illusion that https is more secure than unencrypted http in a
> >> sense of MITM
> >> just because of encryption, it is not.
> >
> >
De
