X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:reply-to:subject:to:references:cc:from
	:message-id:date:mime-version:in-reply-to:content-type
	:content-transfer-encoding; q=dns; s=default; b=pwL/FgFR8T0by8Ma
	kMIzLzEUD+cPz3C3Q0wIMwt1Fb85XM8ozu5UvZXTBWb66Vl0vQ872FFItfkSyuTu
	B/YmCnfe6ymBmKGq75ntw5THCqal7BzemH3mMmOCoCewqSurbQtIGuwUdeuhlCLA
	hnbIWrTp6TYmamBZmbwQNBkHBMQ=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:reply-to:subject:to:references:cc:from
	:message-id:date:mime-version:in-reply-to:content-type
	:content-transfer-encoding; s=default; bh=JStthDmnDECmzajMlHu1WK
	QHku4=; b=TuEtxdQZadOAlKqWl6VW8cyy1KSpPtdsbH8dkRmL9Hz9CS1BU1ZMoC
	Fo/0hI+BoHEOXPtu5WbKbOKCXnKpXyY+f6zhgwqHokAz9ImSj2ziUXJP95a2E1fl
	xy7Bk0S4ajVDLNjnia9kbo5hC97GOz3MxItd5Sl0XdQCDohwvaUBE=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Spam-SWARE-Status: No, score=-2.8 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_LOW autolearn=ham version=3.3.1 spammy=
X-HELO: smtp-out-so.shaw.ca
Reply-To: Brian DOT Inglis AT SystematicSw DOT ab DOT ca
Subject: Re: SSL not required for setup.exe download
To: cygwin AT cygwin DOT com
References: <CANSoFxtW0Jb1M5KfkFGGOxec_D8ysyYCrnk_PXWjHobLDXZauQ AT mail DOT gmail DOT com> <1a840c2e-55ac-0ab4-66c4-a1f6a2c4f81a AT Shaw DOT ca> <CANSoFxtA0vnF1adx4rwyjuMasrVAOGb8hT_Uct-wSdcazj252w AT mail DOT gmail DOT com> <41f12842-ea43-ff63-a660-26ee3b497c63 AT SystematicSw DOT ab DOT ca> <3132c0de-2689-a270-b996-d309017ca815 AT maxrnd DOT com>
Cc: sourcemaster AT sourceware DOT org
From: Brian Inglis <Brian DOT Inglis AT SystematicSw DOT ab DOT ca>
Openpgp: preference=signencrypt
Message-ID: <8d0f9c58-8304-7525-3b9e-0b8e92b1d697@SystematicSw.ab.ca>
Date: Mon, 11 Mar 2019 05:50:28 -0600
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3
MIME-Version: 1.0
In-Reply-To: <3132c0de-2689-a270-b996-d309017ca815@maxrnd.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-IsSubscribed: yes

On 2019-03-10 23:16, Mark Geisert wrote:
> On 2019-03-10, Brian Inglis wrote:
>> On 2019-03-10 10:40, Archie Cobbs wrote:
>>> In any case, the problem I'm talking about is trivial to verify. Just
>>> start up Chrome or Firefox and enter http://www.cygwin.com. You can
>>> then confirm that (a) the page you are looking at has an http:// URL,
>>> and (b) the link to setup.exe also has an http:// URL. Therefore,
>>> there is no real security in this scenario.
>>
>> I only get to see https://www.cygwin.com/ YMMV
> 
> FWIW, I can reproduce the OP's STC using Chrome, Firefox, and Pale Moon.  Not
> sure why it happens for some folks but not others.  But since it does exist for
> some users, should it be dealt with?

It is possible that some of the clients on some of the systems accessing
sourceware projects may not be capable of supporting HTTPS, TLS, or HSTS, so a
permanent 301 redirection to HTTPS:443 may not be feasible.

If the sourcemaster at sourceware.org dealt with the issues below:

	https://hstspreload.org/?domain=sourceware.org

by changing the header from:

	Strict-Transport-Security: max-age=16070400

to:

	Strict-Transport-Security: max-age=16070400; includeSubDomains; preload

it could be automatic soon in most major browsers using the Chromium/Mozilla
preload list:

	https://github.com/chromium/hstspreload.org

but some of us are currently redirected while others are not.

I have probably been using HTTPS in browsers and scripts since it was supported
by sourceware.org and cygwin.com.
It looks like once browsers or clients have seen the HTTPS:443 STS header, or if
a site is on a preload list, they redirect to HTTPS:443; if you use wget, check
for ~/.wget-hsts which should contain {,www.}{cygwin.com,sourceware.org} if you
used wget to access those sites.

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple