Re: [PATCH] Update users.txt to HTTPS

[Tim Ruehsen]

On Thursday, February 16, 2017 1:46:56 PM CET Bruno Haible wrote:
> Tim Ruehsen wrote:
> > I updated the links in users.txt to HTTPS where possible (manually
> > checked). For outdated links I tried to find the current valid links.
> 
> Thanks a lot! I've applied it in your name. The rationale, for me, is that
> http and ftp are vulnerable to man-in-the-middle attacks [1].
> 
> Bruno
> 
> [1] https://lists.gnu.org/archive/html/bug-gnulib/2017-01/msg00102.html

Thanks, and yes, MITM active and passive (reading content) attacks are my 
rationale as well.

It is pretty bad, that many announcements[1] still point to our ftp and http 
sites. How many downloaders check the signatures manually ? 1% ?

Am I the only maintainer using HTTPS (for wget announcements) ?
I already thought about dropping the reference to http://ftpmirror.gnu.org/.
There is no HTTPS pendant.

[1] http://lists.gnu.org/archive/html/info-gnu/2017-02/index.html

Regards, Tim

signature.asc
Description: This is a digitally signed message part.