DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:references:in-reply-to:from:date
	:message-id:subject:to:content-type; q=dns; s=default; b=N+wufur
	00ASHi/IG23cjnTBhq3wLxTmwmpuvmltBKuh7oJmucn9ErNR7kj2+aX7ipnSRJ8M
	fTI6ijSHyy42VVsBjl9nrUNThMwb2ZeS3n0UwUptU8m1yXRdnRAgiYF2N8qQoP4/
	k1X+1v5n1T1k9WqHRvlFevf174WLD2BpyThk=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
MIME-Version: 1.0
References: <CANSoFxtW0Jb1M5KfkFGGOxec_D8ysyYCrnk_PXWjHobLDXZauQ@mail.gmail.com> <1a840c2e-55ac-0ab4-66c4-a1f6a2c4f81a@Shaw.ca>
In-Reply-To: <1a840c2e-55ac-0ab4-66c4-a1f6a2c4f81a@Shaw.ca>
From: Archie Cobbs <archie.cobbs@gmail.com>
Date: Sun, 10 Mar 2019 11:40:28 -0500
Message-ID: <CANSoFxtA0vnF1adx4rwyjuMasrVAOGb8hT_Uct-wSdcazj252w@mail.gmail.com>
Subject: Re: SSL not required for setup.exe download
To: Brian.Inglis@shaw.ca, cygwin@cygwin.com
Content-Type: text/plain; charset="UTF-8"

Hi Brian,

On Sun, Mar 10, 2019 at 9:16 AM Brian Inglis <Brian.Inglis@shaw.ca> wrote:
> > Is there any reason not to force this redirect and close this security hole?
>
> The whole sourceware.org site include cygwin.com uses HSTS which compliant
> supporting clients can use to switch to communicating over HTTPS.
> Clients which are not compliant or don't support HTTPS may still download the
> programs and files.

I don't see how HSTS solves the particular issue that I'm referring to.

HSTS only applies to connections that are *already* using HTTPS.
Quoting Wikipedia:

    HSTS mechanism overview

    A server implements an HSTS policy by supplying a header over an
HTTPS connection (HSTS headers over HTTP are ignored).

In any case, the problem I'm talking about is trivial to verify. Just
start up Chrome or Firefox and enter http://www.cygwin.com. You can
then confirm that (a) the page you are looking at has an http:// URL,
and (b) the link to setup.exe also has an http:// URL. Therefore,
there is no real security in this scenario.

-Archie

-- 
Archie L. Cobbs

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple