Charlie Li via plug on 11 Aug 2020 11:40:33 -0700


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] news 

Rich Freeman via plug wrote:
> On Tue, Aug 11, 2020 at 12:34 PM brent timothy saner via plug wrote:
>>
>> But yeah, he explained much more eloquently the point I'm trying to
>> make. It's important to balance risk factor into the equation, and he
>> explains why it's important here.
> 
> It is also almost completely irrelevant in practice.
> 
It is absolutely completely relevant in practice.
> However, this discussion came up in the context of SSL for websites,
> where turning it on is basically a checkbox unless your website was
> designed in 1996.  There is rarely any reason not to check the box for
> anything which is new.
> 
Oh but there is. This was actually discussed ad nauseum in the context
of the FreeBSD public subversion repositories (not the endpoint for
committers, which of course uses ssh) unconditionally requiring HTTPS,
and one important point brought up are nation-states and other actors
who have vested interests to know everything every user does, which
means any means necessary to MITM and crack SSL/TLS. Which can mean no
access to the (proper) requested resource at all. At the end of the day,
it is all about managing risk.

These two messages from phk explain it much better than I can:
https://lists.freebsd.org/pipermail/freebsd-security/2017-December/009555.html
https://lists.freebsd.org/pipermail/freebsd-security/2017-December/009558.html

-- 
Charlie "house hunting" Li

(This email address is for mailing list use only; replace local-part
with vishwin for off-list communication)

Attachment: signature.asc
Description: OpenPGP digital signature

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug