Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5827

Re: Scripts that run insecurely-downloaded code

Cross-posted to 2 groups.

Show all headers | View raw

On Sat, 2 May 2020 10:14:13 +0200
Davide Prina <davide.prina@gmail.com> wrote:

> On 01/05/20 22:00, Rebecca N. Palmer wrote:
> > On 01/05/2020 20:31, Elmar Stellnberger wrote:
> >> https isn´t any more secure than http as long as you do not have a 
> >> verifiably trustworthy server certificate that you can check for. As 
> >> we know the certification authority system is totally broken.
> > 
> > Imperfect yes, but still better than nothing.
> 
> There is another problem: implementation. Not all the software that 
> implement HTTPS verify the validity of the certificate and the validity 
> of all the certification chain.

I am not a security expert, but see my argument here with the Debian
ssmtp maintainer over whether a package that advertises TLS
functionality but fails to check the received certificate (and does not
mention this anywhere in its documentation) should be considered to have
an 'important' bug ;)

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=662960#51

Celejar

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Scripts that run insecurely-downloaded code "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2020-05-01 21:20 +0200
  Re: Scripts that run insecurely-downloaded code Elmar Stellnberger <estellnb@elstel.org> - 2020-05-01 21:40 +0200
    Re: Scripts that run insecurely-downloaded code "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2020-05-01 22:20 +0200
      Re: Scripts that run insecurely-downloaded code Paul Wise <pabs@debian.org> - 2020-05-02 03:00 +0200
        Re: Scripts that run insecurely-downloaded code estellnb@elstel.org - 2020-05-02 18:10 +0200
      Re: Scripts that run insecurely-downloaded code Davide Prina <davide.prina@gmail.com> - 2020-05-02 10:20 +0200
        Re: Scripts that run insecurely-downloaded code "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2020-05-02 11:10 +0200
        Re: Scripts that run insecurely-downloaded code estellnb@elstel.org - 2020-05-02 18:30 +0200
          Re: Scripts that run insecurely-downloaded code Jason Fergus <leech@thefnords.org> - 2020-05-02 19:00 +0200
            Re: Scripts that run insecurely-downloaded code estellnb@elstel.org - 2020-05-02 19:30 +0200
        Re: Scripts that run insecurely-downloaded code Celejar <celejar@gmail.com> - 2020-05-03 16:40 +0200
    Re: Scripts that run insecurely-downloaded code estellnb@elstel.org - 2020-05-02 18:20 +0200
  Re: Scripts that run insecurely-downloaded code Paul Wise <pabs@debian.org> - 2020-05-02 03:20 +0200

csiph-web