Re: http subversion URLs should be discontinued in favor of https URLs

2017-12-07 Thread Poul-Henning Kamp
In message <83e44188-6e0d-13cc-4b80-d191ac010...@rawbw.com>, Yuri writes: >On 12/07/17 15:16, Jason Hellenthal wrote: >> The truly paranoid types that don’t want anyone to know they are using >> FreeBSD apparently. >> >> Honestly if they are that worried about http then get a private vpn

Re: http subversion URLs should be discontinued in favor of https URLs

2017-12-07 Thread Yuri
On 12/07/17 15:16, Jason Hellenthal wrote: The truly paranoid types that don’t want anyone to know they are using FreeBSD apparently. Honestly if they are that worried about http then get a private vpn tunnel and run through that instead ! Some people aren't aware that they use http, and en

Re: http subversion URLs should be discontinued in favor of https URLs

2017-12-07 Thread Jason Hellenthal
The truly paranoid types that don’t want anyone to know they are using FreeBSD apparently. Honestly if they are that worried about http then get a private vpn tunnel and run through that instead ! > On Dec 7, 2017, at 16:27, Poul-Henning Kamp wrote: > > > In message <2a6d123c-8ee5-8e

Re: http subversion URLs should be discontinued in favor of https URLs

2017-12-07 Thread Poul-Henning Kamp
In message <2a6d123c-8ee5-8e1e-d99b-4bce02345...@rawbw.com>, Yuri writes: >The unfortunate FreeBSD user who updated his source tree through >Tor [...] Why would anybody do that in the first place ? -- Poul-Henning Kamp | UNIX since Zilog Zeus 3.20 p...@freebsd.org | TCP/

Re: http subversion URLs should be discontinued in favor of https URLs

2017-12-07 Thread Yuri
On 12/05/17 12:59, Yuri wrote: I suggested this PR, but it got rejected: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=224097 http is insecure in its nature, and is an easy target for MITM. This is why https should be preferred. http needs to be discontinued and shut down because as long

Re: http subversion URLs should be discontinued in favor of https URLs

2017-12-07 Thread Poul-Henning Kamp
In message <867etyzlad@desk.des.no>, =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= w rites: >Gordon Tetlow writes: >> Assertion of identity and encryption in transit are separate issues. [...] > >You can't have the latter without the former. Assertion of identity is >the only protection again

Re: http subversion URLs should be discontinued in favor of https URLs

2017-12-07 Thread Dag-Erling Smørgrav
Gordon Tetlow writes: > Assertion of identity and encryption in transit are separate issues. I > do agree that identity is fundamentally broken with the existing CA > system. I’m more interested in preventing tampering of data in > transit. HTTPS is an easy way to do that. You can't have the latt