From: "Martin Boßlet" <martin.bosslet@...>
Date: 2013-02-05T04:47:36+09:00
Subject: [ruby-core:51852] Re: SSL for ftp.ruby-lang.org

--047d7b342c4c1e4f0304d4eb0e08
Content-Type: text/plain; charset=ISO-8859-1

+1 for offering TLS/SSL for the downloads.

While publishing the hashes is a first step, as long as they are served
over plain
HTTP it wouldn't prevent any sophisticated attacker from
man-in-the-middling a different web page with forged hashes to the clients
(in
addition to forged download packages).

-Martin


2013/2/4 Marc-Andre Lafortune <ruby-core-mailing-list@marc-andre.ca>

> The MD5 & SAH256 hashes are posted on ruby-lang.org though.
>
> OTOH, www.ruby-lang.org itself does not currently accept https requests.
>
>
> On Sun, Feb 3, 2013 at 5:20 PM, Charlie Somerville <
> charlie@charliesomerville.com> wrote:
>
>> In light of the recent security issues with RubyGems, I think it would be
>> a good idea to look at how Ruby itself is distributed.
>>
>> Currently the main place to download Ruby source distributions is
>> http://ftp.ruby-lang.org/.
>>
>> These downloads are run over cleartext HTTP and are unauthenticated.
>>
>> SSL should be considered for this host so users downloading Ruby can have
>> some assurance that the distribution has not been tampered with.
>>
>> I think eventually SSL should be mandatory, although I'm not sure if this
>> would break software like RVM.
>>
>> Cheers,
>>
>> Charlie
>>
>
>

--047d7b342c4c1e4f0304d4eb0e08
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">+1 for offering TLS/SSL for the downloads.<div><br></div><=
div style>While publishing the hashes is a first step, as long as they are =
served over plain</div><div style>HTTP it wouldn&#39;t prevent any sophisti=
cated attacker from=A0</div>
<div style>man-in-the-middling a different web page with forged hashes to t=
he clients (in</div><div style>addition to forged download packages).</div>=
<div style><br></div><div style>-Martin</div></div><div class=3D"gmail_extr=
a">
<br><br><div class=3D"gmail_quote">2013/2/4 Marc-Andre Lafortune <span dir=
=3D"ltr">&lt;<a href=3D"mailto:ruby-core-mailing-list@marc-andre.ca" target=
=3D"_blank">ruby-core-mailing-list@marc-andre.ca</a>&gt;</span><br><blockqu=
ote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc s=
olid;padding-left:1ex">
<div dir=3D"ltr">The MD5 &amp; SAH256 hashes are posted on=A0<a href=3D"htt=
p://ruby-lang.org" target=3D"_blank">ruby-lang.org</a> though.<div><br></di=
v><div>OTOH, <a href=3D"http://www.ruby-lang.org" target=3D"_blank">www.rub=
y-lang.org</a> itself does not currently accept https requests.</div>


</div><div class=3D"HOEnZb"><div class=3D"h5"><div class=3D"gmail_extra"><b=
r><br><div class=3D"gmail_quote">On Sun, Feb 3, 2013 at 5:20 PM, Charlie So=
merville <span dir=3D"ltr">&lt;<a href=3D"mailto:charlie@charliesomerville.=
com" target=3D"_blank">charlie@charliesomerville.com</a>&gt;</span> wrote:<=
br>


<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">
                <div>In light of the recent security issues with RubyGems, =
I think it would be a good idea to look at how Ruby itself is distributed.
                </div><div><br></div><div>Currently the main place to downl=
oad Ruby source distributions is <a href=3D"http://ftp.ruby-lang.org/" targ=
et=3D"_blank">http://ftp.ruby-lang.org/</a>.</div><div><br></div><div>These=
 downloads are run over cleartext HTTP and are unauthenticated.</div>


<div><br></div><div>SSL should be considered for this host so users downloa=
ding Ruby can have some assurance that the distribution has not been tamper=
ed with.</div><div><br></div><div>I think eventually SSL should be mandator=
y, although I&#39;m not sure if this would break software like RVM.</div>


<div><br></div><div>Cheers,</div><div><br></div><div>Charlie</div>
                <div></div>
            </blockquote></div><br></div>
</div></div></blockquote></div><br></div>

--047d7b342c4c1e4f0304d4eb0e08--