No HTTPS on nginx.org by default
Maxim Konovalov
maxim at nginx.com
Mon Aug 22 17:30:42 UTC 2016
On 8/22/16 8:23 PM, Richard Stanway wrote:
> See https://nginx.org/en/linux_packages.html#stable
>
> PGP key links are hard coded to http URLs:
>
> <p>
> For Debian/Ubuntu, in order to authenticate the nginx repository
> signature
> and to eliminate warnings about missing PGP key during installation
> of the
> nginx package, it is necessary to add the key used to sign the nginx
> packages and repository to the <code>apt</code> program keyring.
> Please download <a href="http://nginx.org/keys/nginx_signing.key">this
> key</a> from our web site, and add it to the <code>apt</code>
> program keyring with the following command:
> </p>
>
Yes, I see. It should be fixed. Thanks.
> On Mon, Aug 22, 2016 at 7:19 PM, Maxim Konovalov <maxim at nginx.com
> <mailto:maxim at nginx.com>> wrote:
>
> On 8/22/16 8:15 PM, Richard Stanway wrote:
> > Could you at least fix the https download page, so it doesn't
> > directly link to a HTTP PGP key?
> >
> It works correctly: https://nginx.org/en/download.html
> <https://nginx.org/en/download.html>
>
> > On Mon, Aug 22, 2016 at 6:49 PM, Maxim Konovalov <maxim at nginx.com <mailto:maxim at nginx.com>
> > <mailto:maxim at nginx.com <mailto:maxim at nginx.com>>> wrote:
> >
> > On 8/22/16 7:41 PM, B.R. wrote:
> > > The problem is, if the GPG key is served through HTTP,
> there is no
> > > way to authenticate it, since it could be compromised
> through
> > MITM.
> > > I am very surprised to see myself being qualified as 'HTTPS
> > despot'
> > > when I just spot the obvious.
> > >
> > But it does not -- our PGP key distributed through a number of
> > channels, including HTTPS. Problem solved, case closed?
> >
> > > Compromised repository + GPG key is one very powerful way of
> > > impersonating another product.
> > >
> > > TLS provides both encryption and authentication, based
> on the
> > > initial shared circle of trust.
> > > Thus you certify the GPG key is authentic and thus, if
> it verifies
> > > the binaries, you ensure the delivered package are
> produced by the
> > > owner of the key, in the end the real author.
> > >
> > > In 2016, stating that content served over HTTP is 'secure'
> > blows my
> > > mind and kills your credibility.
> > >
> > Who did that? What's his name?
> >
> > > Now, as Richard pointed out, if you truly believe you
> need to
> > > provide HTTP-only, you can. It would be better if it was
> in a very
> > > visible fashion, though.
> > > Where was despotism, again?
> >
> > nginx.org <http://nginx.org> <http://nginx.org> already
> has HTTPS therefore it is
> > not HTTP-only.
> >
> > > ---
> > > *B. R.*
> > >
> > > On Mon, Aug 22, 2016 at 5:40 PM, Richard Stanway
> > > <r1ch+nginx at teamliquid.net
> <mailto:r1ch%2Bnginx at teamliquid.net>
> <mailto:r1ch%2Bnginx at teamliquid.net
> <mailto:r1ch%252Bnginx at teamliquid.net>>
> > <mailto:r1ch+nginx at teamliquid.net
> <mailto:r1ch%2Bnginx at teamliquid.net>
> > <mailto:r1ch%2Bnginx at teamliquid.net
> <mailto:r1ch%252Bnginx at teamliquid.net>>>> wrote:
> > >
> > > 1. You could provide insecure.nginx.org <http://insecure.nginx.org>
> <http://insecure.nginx.org>
> > > <http://insecure.nginx.org> mirror for such people, make
> > > nginx.org <http://nginx.org> <http://nginx.org>
> <http://nginx.org> secure by
> > default.
> > >
> > > 2. Modern server CPUs are already extremely energy efficient,
> > > TLS adds negligible load. See https://istlsfastyet.com/
> > >
> > >
> > >
> > > On Mon, Aug 22, 2016 at 12:31 PM, Valentin V. Bartenev
> > > <vbart at nginx.com <mailto:vbart at nginx.com>
> <mailto:vbart at nginx.com <mailto:vbart at nginx.com>>
> <mailto:vbart at nginx.com <mailto:vbart at nginx.com>
> > <mailto:vbart at nginx.com <mailto:vbart at nginx.com>>>> wrote:
> > >
> > > On Sunday 21 August 2016 15:56:09 B.R. wrote:
> > > > It is surprising, since I remember Ilya Grigorik made a talk about TLS
> > > > during the first ever nginx conf in 2014:
> > > > https://www.youtube.com/watch?v=iHxD-G0YjiU
> <https://www.youtube.com/watch?v=iHxD-G0YjiU>
> > <https://www.youtube.com/watch?v=iHxD-G0YjiU
> <https://www.youtube.com/watch?v=iHxD-G0YjiU>>
> > > <https://www.youtube.com/watch?v=iHxD-G0YjiU
> <https://www.youtube.com/watch?v=iHxD-G0YjiU>
> > <https://www.youtube.com/watch?v=iHxD-G0YjiU
> <https://www.youtube.com/watch?v=iHxD-G0YjiU>>>
> > > > https://istlsfastyet.com/
> > >
> > > It's just Ilya's opinion. You are free to agree or not.
> > >
> > >
> > > >
> > > > Thus, there is no reason for not going full-HTTPS in delivering Web pages.
> > >
> > > There are at least two reasons to not use HTTPS:
> > >
> > > 1. Provide easy access to information for people, who can't
> > > use encryption
> > > by political, legal, or technical reasons.
> > >
> > > 2. Don't waste resources on encryption, and thus save our
> > > planet.
> > >
> > > Please, don't be a TLS despot and let people to have a
> > > choice to use encryption
> > > or not.
> > >
> > > I think the situation when I can't download new version of
> > > OpenSSL using old
> > > version of OpenSSL is ridiculous, but they have configured
> > > openssl.org <http://openssl.org>
> <http://openssl.org> <http://openssl.org>
> > that way.
> > > How I supposed to use Internet then?
> > >
> > > wbr, Valentin V. Bartenev
> > >
> >
> >
> > --
> > Maxim Konovalov
> > Join us at nginx.conf, Sept. 7-9, Austin, TX:
> > http://nginx.com/nginxconf
> >
> > _______________________________________________
> > nginx mailing list
> > nginx at nginx.org <mailto:nginx at nginx.org> <mailto:nginx at nginx.org
> <mailto:nginx at nginx.org>>
> > http://mailman.nginx.org/mailman/listinfo/nginx
> <http://mailman.nginx.org/mailman/listinfo/nginx>
> > <http://mailman.nginx.org/mailman/listinfo/nginx
> <http://mailman.nginx.org/mailman/listinfo/nginx>>
> >
> >
> >
> >
> > _______________________________________________
> > nginx mailing list
> > nginx at nginx.org <mailto:nginx at nginx.org>
> > http://mailman.nginx.org/mailman/listinfo/nginx
> <http://mailman.nginx.org/mailman/listinfo/nginx>
> >
>
>
> --
> Maxim Konovalov
> Join us at nginx.conf, Sept. 7-9, Austin, TX:
> http://nginx.com/nginxconf
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org <mailto:nginx at nginx.org>
> http://mailman.nginx.org/mailman/listinfo/nginx
> <http://mailman.nginx.org/mailman/listinfo/nginx>
>
>
>
>
> _______________________________________________
> nginx mailing list
> nginx at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
--
Maxim Konovalov
Join us at nginx.conf, Sept. 7-9, Austin, TX: http://nginx.com/nginxconf
More information about the nginx
mailing list