X-Authentication-Warning: delorie.com: mail set sender to geda-user-bounces using -f
X-Recipient: geda-user AT delorie DOT com
X-Original-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=
	messagingengine.com; h=content-transfer-encoding:content-type
	:date:from:in-reply-to:message-id:mime-version:references
	:reply-to:subject:to:x-me-proxy:x-me-proxy:x-me-sender
	:x-me-sender:x-sasl-enc; s=fm1; bh=djGJRe5evRfhZq0bfjbVBV2HEJrDY
	84OaE9skJOrNmI=; b=KJXVhe1ueIkks10kLW/x81rh5sTlK72erSKB7K52qfDEv
	OgvNK2U03zPqWEbiyC9eRAQ+q3F0FbMull/udgfPDaoQqLyKt6KevcwwOT277tHV
	ZoNXpVLVzriwASnkCudFZPw3iqP4E3hBltcoPLyrVrVkUg20G9wNy2G+9rczl0ii
	kiq+yYcOjb+i3BHtLdQesSCGz+V3AGoxlCPANH1DfXjEIFkDeROdxgJlicYO5Kxo
	oXYVZQhUAKv4MenRL9rpGAMxftb+AulTK24VhlV8MmASsFEM3xdhbEwkvotc4vO9
	6I24UBUR1FBxgcPdsLk+rF37wZDCMiJdBhX0UtiCA==
X-ME-Sender: <xms:E_X9X55stEfHeIDHjz-ZibY38UU2M_y0Kb68XMP8MOpIK64JO8_VNA>
    <xme:E_X9X25PBg-Psp3vRvVFe7GTyaF6iOp08YDNCj4HL58DoBNSpkaZ1QT-YPemhC0Aa
    LutHSZBSWuEm4nCMg>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedukedrtddtgdeludcutefuodetggdotefrodftvf
    curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu
    uegrihhlohhuthemuceftddtnecunecujfgurheprhfuvfhfhffkffgfgggjtgfgsehtje
    ertddtfeejnecuhfhrohhmpefiihhrvhhinhcujfgvrhhruceoghhhvghrrhhlsehfrghs
    thhmrghilhdrtghomheqnecuggftrfgrthhtvghrnhepvdduleffgfduudeiveevleeike
    evteeigffhhedvhfejvdffjeeiieelffejhfdvnecukfhppedutdekrddvudehrdduleeh
    rddvtdehnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomh
    epghhhvghrrhhlsehfrghsthhmrghilhdrtghomh
X-ME-Proxy: <xmx:E_X9Xwf-1KWAN8zUy5iL5u1hoDJBk_VtIJ5ZUxZmdHIaMafmkaOZPg>
    <xmx:E_X9XyLfQX29Lcf5CDqOtZT0W8vZmxgVCxrSRMTLdyX54YWluItZYQ>
    <xmx:E_X9X9JRIO_4_pKgbqJ7Bv24X4e-nqCdujOMmMfJ4lhYf_dYK-a4jw>
    <xmx:E_X9XyWN3q5cbMW-_jtLxUJsbnN_4iH0unkSwmGHp2lw7i5KCQrQ-H-4dpo>
Subject: Re: [geda-user] No https for pcb-rnd [SOLVED]
To: geda-user AT delorie DOT com
References: <xnim84jsdh DOT fsf AT envy DOT delorie DOT com>
From: "Girvin Herr (gherrl AT fastmail DOT com) [via geda-user AT delorie DOT com]" <geda-user AT delorie DOT com>
Message-ID: <8a3a4ed0-3ba4-1612-92d1-89c590b469fa@fastmail.com>
Date: Tue, 12 Jan 2021 11:11:57 -0800
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:68.0) Gecko/20100101
 Thunderbird/68.12.0
MIME-Version: 1.0
In-Reply-To: <xnim84jsdh.fsf@envy.delorie.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Reply-To: geda-user AT delorie DOT com
Errors-To: nobody AT delorie DOT com
X-Mailing-List: geda-user AT delorie DOT com
X-Unsubscribes-To: listserv AT delorie DOT com
Precedence: bulk


On 1/10/21 3:15 PM, DJ Delorie wrote:
> "Girvin Herr (gherrl AT fastmail DOT com) [via geda-user AT delorie DOT com]"
> <geda-user AT delorie DOT com> writes:
>> I don't know why you are so resistant to computer security.
> Computer security takes time and effort, and it's wasted on static data
> that has no real value.  Do you really need to hide the fact that you're
> looking at EDA software?  Do you worry that terrorists are going to
> modify a wiki page you're reading?
>
>> Why did I post my concern about pcb-rnd on this forum? Good question. I
>> thought about it a while and decided that since pcb-rnd was on this
>> forum in the past, and that it may be polled by the pcb-rnd devs,
> Nope, none of them are here any more.  They left long ago.
>
>> Now that includes gEDA too.
> You didn't mention that at all in your original email ;-)
>
>> I hope the gEDA server maintainers create a https portal on the web
>> server(s) asap.
> The gEDA server is a very old arm-based device running a prototype
> operating system.  HTTPS is not an option at this point, unless someone
> (or many someones) steps up to migrate everything to a modern server.

Greetings,

This has been an enlightening discussion. I thank all participants for 
their input.

I thank Erich for reminding me of the check files. I use them all the 
time, but for some reason that security method was not in my mind when I 
started this thread. The use of these check files are not foolproof, but 
they do give me a reasonable level of trust to the source.

I thank DJ for enlightening me on the limitations of the server and how 
they impact upgrading and installing a secure portal on it. I understand 
completely.

Last, I thank everyone who brought to my attention that the gEDA website 
does not use a login and so does not need a secure portal to protect any 
sensitive information such as logins and passwords. Thus creating a 
secure portal on it is moot.

This discussion has led me to amend my computer security procedures to 
allow for sites such as gEDA. I need to focus on those sites that do 
require transmission of sensitive data and which do not use a secure 
portal to do so.

My trust in gEDA has been restored and I am marking this thread as 
Solved. I apologize if I have rattled any chains.

Thanks again.

Girvin