DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:references:in-reply-to:from:date
	:message-id:subject:to:content-type; q=dns; s=default; b=pD+jcNo
	NvNbO8oJaKT1tvhtT8+z78PVksVjOPrrMHX3tAEOmEHLihFCo7/+C+yH/hgMLJKO
	K3YTi5kWoPqZ6BCPpQVXSoC9zHFS2UNR+J3ygkpP+SVRR/6acXfalWH8javVSX2w
	UzbtiYN+c7Q1zDRmzunE+piznsam1l7PeJO0=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
MIME-Version: 1.0
References: <CANSoFxtW0Jb1M5KfkFGGOxec_D8ysyYCrnk_PXWjHobLDXZauQ@mail.gmail.com> <1a840c2e-55ac-0ab4-66c4-a1f6a2c4f81a@Shaw.ca> <CANSoFxtA0vnF1adx4rwyjuMasrVAOGb8hT_Uct-wSdcazj252w@mail.gmail.com> <41f12842-ea43-ff63-a660-26ee3b497c63@SystematicSw.ab.ca>
In-Reply-To: <41f12842-ea43-ff63-a660-26ee3b497c63@SystematicSw.ab.ca>
From: Archie Cobbs <archie.cobbs@gmail.com>
Date: Mon, 11 Mar 2019 08:43:57 -0500
Message-ID: <CANSoFxtLzGgcOhrsu4h0eXXnpezB6v17cGwOrqy6SjSvJ__gLA@mail.gmail.com>
Subject: Re: SSL not required for setup.exe download
To: Brian.Inglis@systematicsw.ab.ca, cygwin@cygwin.com
Content-Type: text/plain; charset="UTF-8"

On Sun, Mar 10, 2019 at 10:51 PM Brian Inglis
<Brian.Inglis@systematicsw.ab.ca> wrote:
> >>> Is there any reason not to force this redirect and close this security hole?
>
> There are apparently reasons not to force this redirect as it can also cause a
> security hole.

That's really interesting. Can you provide more detail?

> >> The whole sourceware.org site include cygwin.com uses HSTS which compliant
> >> supporting clients can use to switch to communicating over HTTPS.
> >> Clients which are not compliant or don't support HTTPS may still download the
> >> programs and files.
> >
> > I don't see how HSTS solves the particular issue that I'm referring to.
>
> HSTS redirects requests from port 80 to 443 (HTTPS).

Not for me. Well, actually I'm getting inconsistent results...

On Mac OS X, neither Firefox, Chrome nor Safari will redirect to SSL.

On an old Windows 7 system, neither IE 8 (no surprise there) or Chrome
redirects.

However, with Chrome, it does not redirect at first, but once I've
manually entered https://www.cygwin.com it seems to "realize" that a
secure site exists, and after that it starts redirecting to SSL.

I can revert that behavior by clearing the cache.

So it seems in the case of Chrome, it has to be "taught" about the
existence of the secure site... which of course takes us right back to
the original problem.

-AC

-- 
Archie L. Cobbs

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple