X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:subject:from:to:date:in-reply-to
	:references:content-type:mime-version:content-transfer-encoding;
	q=dns; s=default; b=u0pRIs73LPtmRRUWH7PF0SpSfrFQ4nAVzhd/7jBagbt
	dppZotHYoaqFplrblJsdz5tfUqn2MvfXR80u/bGCfeMPzzcHMHAVCneuy8ooZ63/
	vgItfQt/s3vx55Ms5HxyFa2TJGlRehI7ax0IVKIO3/7iL1CIHThVI6UhZhRcFvIw
	=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:subject:from:to:date:in-reply-to
	:references:content-type:mime-version:content-transfer-encoding;
	s=default; bh=mrsaSaOVvHzlVD3QSb4/HMRr4Ko=; b=scgK1RqubmRWzKBEP
	+Mo7Zhn1s4aEBAU6jt3rym9P+kFtNsF1IsCnd7gtQncRIMw2+vgcyclLJNRw58rB
	LZfdQbOxOr7u2yGeHKa8jE/RZACOf7JBJdWGzbT40zC0L5aQF22hXB9QyoLGjrp9
	rNu5OnYjqelJuyd1ygv/pSyqhY=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Virus-Found:	No
X-Spam-SWARE-Status:	No, score=-1.6 required=5.0 tests=AWL,BAYES_00,SPF_HELO_PASS autolearn=ham version=3.3.2
X-HELO:	mx1.redhat.com
Message-ID:	<1425027013.11676.45.camel@cygwin.com>
Subject:	Re: Cygwin website uses http: (not https:) for .exe downloads, allowing man-in-the-middle attack
From:	Yaakov Selkowitz <yselkowitz AT cygwin DOT com>
To:	cygwin AT cygwin DOT com
Date:	Fri, 27 Feb 2015 02:50:13 -0600
In-Reply-To:	<E1YR6y2-0008G9-Gr@rmm6prod02.runbox.com>
References:	<E1YR6y2-0008G9-Gr AT rmm6prod02 DOT runbox DOT com>
Mime-Version:	1.0
X-IsSubscribed:	yes

On Thu, 2015-02-26 at 17:31 -0500, David A. Wheeler wrote:
> The Cygwin front web page ( https://www.cygwin.com/ ) says:
> "Install it by running setup-x86.exe (32-bit installation) or
>  setup-x86_64.exe (64-bit installation)."
> 
> However, both of the links to those .exe executables explicitly
> use "http://", and not "https://", even when you go to the https
> version of the Cygwin website.

The links are now relative, so this should no longer be an issue.

Thanks for reporting,

Yaakov



--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -