DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:references:in-reply-to:from:date
	:message-id:subject:to:content-type; q=dns; s=default; b=uRHvA0C
	WVm19BI2b0uoR1UVmlGR7xyspcrUY249No+RXFvWhL7IB/EDR+FA25YGHK5lFqji
	vX6UB1IW7G4eiFzIdhf5s3Xp2g+k5WYQsUVeQTkRVah4k4rL390WwFfMhFHG0xJT
	t1GXUYxQqDqyIVVc/niIKU/XH0O23QnboQ8c=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
MIME-Version: 1.0
References: <CANSoFxtW0Jb1M5KfkFGGOxec_D8ysyYCrnk_PXWjHobLDXZauQ@mail.gmail.com> <1a840c2e-55ac-0ab4-66c4-a1f6a2c4f81a@Shaw.ca> <CANSoFxtA0vnF1adx4rwyjuMasrVAOGb8hT_Uct-wSdcazj252w@mail.gmail.com> <41f12842-ea43-ff63-a660-26ee3b497c63@SystematicSw.ab.ca> <CANSoFxtLzGgcOhrsu4h0eXXnpezB6v17cGwOrqy6SjSvJ__gLA@mail.gmail.com> <1b570593-0ec7-0890-26ef-7e7468534f47@SystematicSw.ab.ca> <CANSoFxsq+5OfRH7RF3QdpMSJU-4JAKSCZM-rUUysP5Y3myR0+Q@mail.gmail.com> <CAD8GWsu+P_d8RCiibkZ068oRAf8yeu=W5CLFO+ZNXGxjUcBOpw@mail.gmail.com> <CANSoFxu7sNUqP3zSKHiFULBrvOkhPFRuc8MyAHojAGFNu-O_xQ@mail.gmail.com> <ecebba35-b0d0-b996-8a78-47e0e8d33572@SystematicSw.ab.ca> <CANSoFxsNHmOEXDvbQC2MevYjYxcfoGH2BK5UhmnuYA44OUg3-Q@mail.gmail.com> <ac07a8bc-f30a-a68c-5392-c077204f8afe@SystematicSw.ab.ca>
In-Reply-To: <ac07a8bc-f30a-a68c-5392-c077204f8afe@SystematicSw.ab.ca>
From: Erik Soderquist <erik.soderquist@gmail.com>
Date: Thu, 28 Mar 2019 14:13:07 -0400
Message-ID: <CACoZoo0e=zfSECFHNUk2_RT2dV8fYTeMwJwQ+=mZw5UT0fo0Vg@mail.gmail.com>
Subject: Re: SSL not required for setup.exe download
To: cygwin <cygwin@cygwin.com>
Content-Type: text/plain; charset="UTF-8"

On Fri, Mar 15, 2019 at 8:25 AM Brian Inglis wrote:
> ... corporate policies, proxies, firewalls, security products.
> Systems or images older than a year may need the new root CA installed - some
> enterprises are very selective about including support for anything in their
> images - and users may not have root CA store access.

I am one of these; a few sites I maintain are behind corporate
firewalls that explicitly block access to sites that can't scan the
communications on to prevent leaking of sensitive internal data.  For
these sites I have no choice but to use the http connections to be
able to update, and I also download signatures and verify against
public keys that the file is indeed the correct file rather than
something injected by an MitM attack before executing.  (Yes, this has
saved my bacon a couple times).

If http is disabled, these sites likely will never be updated again.

-- Erik

--
"I do not think any of us are truly sane, Caleb. Not even you. Courage
is not sanity. Being willing to die for someone else is not sanity."
... "Love is not sane, nor is faith." ... "If sanity lacks those
things, Caleb, I want no part of it."

-- Alexandria Terri in "Weaving the Wyvern" by Alexis Desiree Thorne

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple