X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:in-reply-to:references:from:date
	:message-id:subject:to:content-type:content-transfer-encoding;
	 q=dns; s=default; b=Lo2/xc+jiJHYnn9aI1IVlDG2AQqZjMolZ/ofqUs9wm9
	Q1LjPEJ4x0yV+bC14KuOMZ9JkLW9WhV1/SVScQk1Gb5lKy7g2VrVI2Tr949yrOBh
	HJwC1mrsSTefv+qCVO6oFBybAPFRiltJrYhG/YCyK0n07EWj0M2mz8oMGzs/+0QM
	=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:in-reply-to:references:from:date
	:message-id:subject:to:content-type:content-transfer-encoding;
	 s=default; bh=p56tbUyFAn96Ebji5MwnEw14XMg=; b=luVriEBIdvZwD5KDx
	FQQE5CZko3xozKD8anFSsBmaArOQ8mHfoJOzdJxBi7branm56qDGJoeG6YQKQQQO
	nK1BRPl7OnSjlg8YIKhYtxhOTIeSEQWUM/KPdgNjMDKeqNMXsnt0uozfXAiyg0fa
	ajrcp9rN0ZyVGs3b51ybwudduk=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Spam-SWARE-Status: No, score=-0.6 required=5.0 tests=AWL,BAYES_00,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=no version=3.3.1 spammy=antiviruses, occasion, avast, alerts
X-HELO: mail-qk1-f182.google.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;        d=gmail.com; s=20161025;        h=mime-version:in-reply-to:references:from:date:message-id:subject:to         :content-transfer-encoding;        bh=KmGp2l+PQFzvPqXJN46dO1W1CDPkIOmXf8YpZZSLMfY=;        b=Y0P9JdNBjIjLvhMnEzUZs6c7XSR/mov0gnr08MI47YFgltgNjG9etujDO+5i8yHBvs         MoN2JrQl4xBFS8tdx8UZ4FmyITW/jFpLGh+RGADLOkaBS6UlSf8Sf7MBqNHHB+RsGDhT         Lc10QtAJtHnAg77zafumecy3bVDJQ9rxchJxG1FV1kVHHGmonyFggnbOO0wjrcgm2BLC         ymGQ2iDSTKsUm1nMFlEhr6zpY/CReXk1moZc10QdVph4N9Dr3BMvgE0cGtS8AeZ8S5Ax         CoTjSmi/61CMlqqjBcXmt8EnrfDzD1xrWiF90dguk0oHyg/t/N2QJAc4KxjEDnU8pQd0         B9pg==
MIME-Version: 1.0
In-Reply-To: <1981364213.20190313002439@yandex.ru>
References: <CANSoFxtW0Jb1M5KfkFGGOxec_D8ysyYCrnk_PXWjHobLDXZauQ AT mail DOT gmail DOT com> <1a840c2e-55ac-0ab4-66c4-a1f6a2c4f81a AT Shaw DOT ca> <CANSoFxtA0vnF1adx4rwyjuMasrVAOGb8hT_Uct-wSdcazj252w AT mail DOT gmail DOT com> <41f12842-ea43-ff63-a660-26ee3b497c63 AT SystematicSw DOT ab DOT ca> <CANSoFxtLzGgcOhrsu4h0eXXnpezB6v17cGwOrqy6SjSvJ__gLA AT mail DOT gmail DOT com> <1b570593-0ec7-0890-26ef-7e7468534f47 AT SystematicSw DOT ab DOT ca> <CANSoFxsq+5OfRH7RF3QdpMSJU-4JAKSCZM-rUUysP5Y3myR0+Q AT mail DOT gmail DOT com> <1406950005 DOT 20190312031618 AT yandex DOT ru> <CAD8GWsv=R+G5P9_fNvMvC1+txqPELr=5s3R38jiPyCUj0AcTFg AT mail DOT gmail DOT com> <1981364213 DOT 20190313002439 AT yandex DOT ru>
From: Lee <ler762 AT gmail DOT com>
Date: Tue, 12 Mar 2019 17:50:51 -0400
Message-ID: <CAD8GWsuVV-z+17EYVVN2vMZ-QUtCEeXzVtVN0zh8T+NbPp60qA@mail.gmail.com>
Subject: Re: SSL not required for setup.exe download
To: cygwin AT cygwin DOT com
Content-Type: text/plain; charset="UTF-8"
X-IsSubscribed: yes
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by delorie.com id x2CLp204007937

On 3/12/19, Andrey Repin wrote:
> Greetings, Lee!
>
>>> It gives you false sense of security. What is worse, everybody is
>>> attempting
>>> to reassure this false sense on every possible occasion.
>
>> I don't think it's a false sense of security.  https:// isn't "safe"
>> but it is _safer_ than http://
>
> Yep. Now, let's recall mcafee, norton, kaspersky, avast… and all those
> other
> "antiviruses" that proxy all TLS traffic through their own root certificate
> proxy.

But you did that to yourself.  Hopefully you evaluated the risk/reward
in letting your a/v intercept everything.  Or are at least aware that
your a/v is intercepting everything.

Altho I have a feeling most home users aren't aware of
  https://www.us-cert.gov/ncas/alerts/TA17-075A
I haven't been paying attention - hopefully the situation has improved.

Regards,
Lee

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple