<div dir="ltr">Could you at least fix the https download page, so it doesn't directly link to a HTTP PGP key?</div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Aug 22, 2016 at 6:49 PM, Maxim Konovalov <span dir="ltr"><<a href="mailto:maxim@nginx.com" target="_blank">maxim@nginx.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 8/22/16 7:41 PM, B.R. wrote:<br>
> The problem is, if the GPG key is served through HTTP, there is no<br>
> way to authenticate it, since it could be compromised through MITM.<br>
> I am very surprised to see myself being qualified as 'HTTPS despot'<br>
> when I just spot the obvious.<br>
><br>
But it does not -- our PGP key distributed through a number of<br>
channels, including HTTPS. Problem solved, case closed?<br>
<br>
> Compromised repository + GPG key is one very powerful way of<br>
> impersonating another product.<br>
><br>
> TLS provides both encryption and authentication, based on the<br>
> initial shared circle of trust.<br>
> Thus you certify the GPG key is authentic and thus, if it verifies<br>
> the binaries, you ensure the delivered package are produced by the<br>
> owner of the key, in the end the real author.<br>
><br>
> In 2016, stating that content served over HTTP is 'secure' blows my<br>
> mind and kills your credibility.<br>
><br>
Who did that? What's his name?<br>
<br>
> Now, as Richard pointed out, if you truly believe you need to<br>
> provide HTTP-only, you can. It would be better if it was in a very<br>
> visible fashion, though.<br>
> Where was despotism, again?<br>
<br>
<a href="http://nginx.org" rel="noreferrer" target="_blank">nginx.org</a> already has HTTPS therefore it is not HTTP-only.<br>
<br>
> ---<br>
> *B. R.*<br>
<span class="">><br>
> On Mon, Aug 22, 2016 at 5:40 PM, Richard Stanway<br>
> <<a href="mailto:r1ch%2Bnginx@teamliquid.net">r1ch+nginx@teamliquid.net</a> <mailto:<a href="mailto:r1ch%2Bnginx@teamliquid.net">r1ch+nginx@teamliquid.<wbr>net</a>>> wrote:<br>
><br>
> 1. You could provide <a href="http://insecure.nginx.org" rel="noreferrer" target="_blank">insecure.nginx.org</a><br>
</span>> <<a href="http://insecure.nginx.org" rel="noreferrer" target="_blank">http://insecure.nginx.org</a>> mirror for such people, make<br>
> <a href="http://nginx.org" rel="noreferrer" target="_blank">nginx.org</a> <<a href="http://nginx.org" rel="noreferrer" target="_blank">http://nginx.org</a>> secure by default.<br>
<span class="">><br>
> 2. Modern server CPUs are already extremely energy efficient,<br>
> TLS adds negligible load. See <a href="https://istlsfastyet.com/" rel="noreferrer" target="_blank">https://istlsfastyet.com/</a><br>
><br>
><br>
><br>
> On Mon, Aug 22, 2016 at 12:31 PM, Valentin V. Bartenev<br>
</span><span class="">> <<a href="mailto:vbart@nginx.com">vbart@nginx.com</a> <mailto:<a href="mailto:vbart@nginx.com">vbart@nginx.com</a>>> wrote:<br>
><br>
> On Sunday 21 August 2016 15:56:09 B.R. wrote:<br>
> > It is surprising, since I remember Ilya Grigorik made a talk about TLS<br>
> > during the first ever nginx conf in 2014:<br>
> > <a href="https://www.youtube.com/watch?v=iHxD-G0YjiU" rel="noreferrer" target="_blank">https://www.youtube.com/watch?<wbr>v=iHxD-G0YjiU</a><br>
> <<a href="https://www.youtube.com/watch?v=iHxD-G0YjiU" rel="noreferrer" target="_blank">https://www.youtube.com/<wbr>watch?v=iHxD-G0YjiU</a>><br>
> > <a href="https://istlsfastyet.com/" rel="noreferrer" target="_blank">https://istlsfastyet.com/</a><br>
><br>
> It's just Ilya's opinion. You are free to agree or not.<br>
><br>
><br>
> ><br>
> > Thus, there is no reason for not going full-HTTPS in delivering Web pages.<br>
><br>
> There are at least two reasons to not use HTTPS:<br>
><br>
> 1. Provide easy access to information for people, who can't<br>
> use encryption<br>
> by political, legal, or technical reasons.<br>
><br>
> 2. Don't waste resources on encryption, and thus save our<br>
> planet.<br>
><br>
> Please, don't be a TLS despot and let people to have a<br>
> choice to use encryption<br>
> or not.<br>
><br>
> I think the situation when I can't download new version of<br>
> OpenSSL using old<br>
> version of OpenSSL is ridiculous, but they have configured<br>
</span>> <a href="http://openssl.org" rel="noreferrer" target="_blank">openssl.org</a> <<a href="http://openssl.org" rel="noreferrer" target="_blank">http://openssl.org</a>> that way.<br>
<span class="im HOEnZb">> How I supposed to use Internet then?<br>
><br>
> wbr, Valentin V. Bartenev<br>
><br>
<br>
<br>
</span><span class="im HOEnZb">--<br>
Maxim Konovalov<br>
Join us at nginx.conf, Sept. 7-9, Austin, TX: <a href="http://nginx.com/nginxconf" rel="noreferrer" target="_blank">http://nginx.com/nginxconf</a><br>
<br>
</span><div class="HOEnZb"><div class="h5">______________________________<wbr>_________________<br>
nginx mailing list<br>
<a href="mailto:nginx@nginx.org">nginx@nginx.org</a><br>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx" rel="noreferrer" target="_blank">http://mailman.nginx.org/<wbr>mailman/listinfo/nginx</a></div></div></blockquote></div><br></div>