DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:reply-to:message-id:to:subject
	:in-reply-to:references:mime-version:content-type
	:content-transfer-encoding; q=dns; s=default; b=TFRE1QG5Pz8RsLyY
	jNE01oIwIiIuwkWLd4TK6mpq+6ZoXEI0I53BRwHsMOqwxmLH82QmTzdql+VyYz5J
	E/adqiWKEh1o4vBJNVkfv67UJSSGs3b9jL9DejeR301+IchBJ8aF+4jbSczQ8bAO
	34SwY7Uwc5n4dQWVNxLkVip/3OY=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Date: Wed, 13 Mar 2019 00:34:20 +0300
From: Andrey Repin <anrdaemon@yandex.ru>
Reply-To: cygwin@cygwin.com
Message-ID: <3510142791.20190313003420@yandex.ru>
To: Lee <ler762@gmail.com>, cygwin@cygwin.com
Subject: Re: SSL not required for setup.exe download
In-Reply-To: <CAD8GWstmfqEomcMJ4zu75LLGyy236bkp3EN_CxMewMkJX+e5OQ@mail.gmail.com>
References: <CANSoFxtW0Jb1M5KfkFGGOxec_D8ysyYCrnk_PXWjHobLDXZauQ@mail.gmail.com>   <1a840c2e-55ac-0ab4-66c4-a1f6a2c4f81a@Shaw.ca>  <CANSoFxtA0vnF1adx4rwyjuMasrVAOGb8hT_Uct-wSdcazj252w@mail.gmail.com>  <41f12842-ea43-ff63-a660-26ee3b497c63@SystematicSw.ab.ca>  <CANSoFxtLzGgcOhrsu4h0eXXnpezB6v17cGwOrqy6SjSvJ__gLA@mail.gmail.com>  <1b570593-0ec7-0890-26ef-7e7468534f47@SystematicSw.ab.ca>  <CANSoFxsq+5OfRH7RF3QdpMSJU-4JAKSCZM-rUUysP5Y3myR0+Q@mail.gmail.com>  <1406950005.20190312031618@yandex.ru>  <CAD8GWsv=R+G5P9_fNvMvC1+txqPELr=5s3R38jiPyCUj0AcTFg@mail.gmail.com>  <1715197846.20190312233340@yandex.ru>  <CAD8GWstmfqEomcMJ4zu75LLGyy236bkp3EN_CxMewMkJX+e5OQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Greetings, Lee!

>> Greetings, Lee!
>>
>>>> Which is way worse in my opinion, than any theoretical MITM attack,
>>>> which
>>>> is easily mitigated with proper validation of your downloads.
>>
>>> Serious question - exactly how does one do "proper validation of your
>>> downloads"?
>>
>> Use PGP signature to validate the installer. Use separate channel to obtain
>> trust records for PGP key used in signing.

> Yes, in the ideal world.  But at least in my experience, most windows
> software doesn't come with a pgp signature & using a separate channel
> to get the pgp key isn't so easy.

In my experience, this is a Cygwin mailing list and we're discussing issues
of obtaining and verifying the authenticity of setup.exe.

P.S.
In regard to Cygwin mailing list, please teach your mail agent to not quote
raw email addresses.


-- 
With best regards,
Andrey Repin
Wednesday, March 13, 2019 0:32:21

Sorry for my terrible english...


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple