X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:reply-to:message-id:to:subject
	:in-reply-to:references:mime-version:content-type
	:content-transfer-encoding; q=dns; s=default; b=uUie5soy+7lchVhk
	f3IztJ8pNNzCnV3fXgR9mBPslr4y2pNnMnN9phCZER3tpjmqyrH7IjMCB9HaZmrn
	1kRLHLW/gfOLPq7jMLIAzMt2pNWolgiUt4VQW07N9FwvHOW1af0xbolpA1GQVGCx
	NJ+cAb9L36Hu6sxzpqRvSU+ZN+Y=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:reply-to:message-id:to:subject
	:in-reply-to:references:mime-version:content-type
	:content-transfer-encoding; s=default; bh=qXWaZzmtjDzb1NLaD6EKEL
	mOaW4=; b=lfQB6LAkkjhpMob8QKCApa7KAOWE70QK3v5ccN+Ka7LSC5IsPB4OTK
	/VgHgyDwtreb6l8QciimekHwM6HgOsB+PP7zryA0KM7e8tsIFz6h8v0cui1LPR4X
	qYxiiFqbY7J+kdLI5OgYPYumvmy8vbNuf+X0ZwgNOOeUkgJJVPKoQ=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Spam-SWARE-Status: No, score=-0.7 required=5.0 tests=BAYES_00,FREEMAIL_FROM,KAM_THEBAT,RCVD_IN_DNSWL_LOW autolearn=no version=3.3.1 spammy=occasion, unlimited, HX-Languages-Length:1867, reassure
X-HELO: forward102j.mail.yandex.net
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1552350002;	bh=EVbx+KTHxjWPfVdqs5f95vrsbMQp7rolBDFlY2Aj6hk=;	h=In-Reply-To:Subject:To:Reply-To:From:Message-ID:References:Date;	b=eQ7oS59n5WQNTcDBkOPu9Xne2A6gsbnYuLDGsM3IRGtEEfw+6fvB+6DO2wU+RljPi	 Uf+YFfb5GQ/J+cz3eGQ4RDaQklqN8aie+0342mlBZfSFh+rpMuolVPR5SUBZ29XbHw	 1UMnKY53LmWdyknWPzSLeQWMOQ9FICH4BIBucrH0=
Authentication-Results: mxback9j.mail.yandex.net; dkim=pass header.i=@yandex.ru
Date: Tue, 12 Mar 2019 03:16:18 +0300
From: Andrey Repin <anrdaemon AT yandex DOT ru>
Reply-To: cygwin AT cygwin DOT com
Message-ID: <1406950005.20190312031618@yandex.ru>
To: Archie Cobbs <archie DOT cobbs AT gmail DOT com>, cygwin AT cygwin DOT com
Subject: Re: SSL not required for setup.exe download
In-Reply-To: <CANSoFxsq+5OfRH7RF3QdpMSJU-4JAKSCZM-rUUysP5Y3myR0+Q@mail.gmail.com>
References: <CANSoFxtW0Jb1M5KfkFGGOxec_D8ysyYCrnk_PXWjHobLDXZauQ AT mail DOT gmail DOT com>   <1a840c2e-55ac-0ab4-66c4-a1f6a2c4f81a AT Shaw DOT ca>  <CANSoFxtA0vnF1adx4rwyjuMasrVAOGb8hT_Uct-wSdcazj252w AT mail DOT gmail DOT com>  <41f12842-ea43-ff63-a660-26ee3b497c63 AT SystematicSw DOT ab DOT ca>  <CANSoFxtLzGgcOhrsu4h0eXXnpezB6v17cGwOrqy6SjSvJ__gLA AT mail DOT gmail DOT com>  <1b570593-0ec7-0890-26ef-7e7468534f47 AT SystematicSw DOT ab DOT ca>  <CANSoFxsq+5OfRH7RF3QdpMSJU-4JAKSCZM-rUUysP5Y3myR0+Q AT mail DOT gmail DOT com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-IsSubscribed: yes

Greetings, Archie Cobbs!

> On Mon, Mar 11, 2019 at 2:43 PM Brian Inglis

>> On 2019-03-11 07:43, Archie Cobbs wrote:
>> > On Sun, Mar 10, 2019 at 10:51 PM Brian Inglis wrote:
>> >>>>> Is there any reason not to force this redirect and close this security hole?
>> >> There are apparently reasons not to force this redirect as it can also cause a
>> >> security hole.
>> > That's really interesting. Can you provide more detail?
>>
>> Search for HTTP HTTPS redirection SSL stripping MitM attack

> I did, but I only get results relating to the "stripping" attack,
> which downgrades from HTTPS to HTTP.

> Obviously that would cause a reduction in security... But what I'm
> suggesting is the opposite: redirecting from HTTP to HTTPS.

> How could that reduce security?

> (sigh)

> I must say I'm surprised so many people think it's a good idea to
> leave cygwin open to trivial MITM attacks, which is the current state
> of affairs.

> This is my opinion only of course, but if cygwin wants to have any
> security credibility, it should simply disallow non-SSL downloads of
> setup.exe. Otherwise the chain of authenticity is broken forever.

All the SSL stuff is build on idea of implicit unlimited trust.
Which is way worse in my opinion, than any theoretical MITM attack, which is
easily mitigated with proper validation of your downloads.
It gives you false sense of security. What is worse, everybody is attempting
to reassure this false sense on every possible occasion.

P.S.
Unrelated to the ongoing discussion, please teach your mail client to not
quote raw email addresses.
The mailing list is publicly archived.
There's no pressing need to feed every spambot in existence with a new batch
of fresh targets.


-- 
With best regards,
Andrey Repin
Tuesday, March 12, 2019 3:11:28

Sorry for my terrible english...


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple