Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72339
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.180 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <1386084526.20140206011339@cypressintegrated.com>
References: <CAH8Mpn=Kw9CCmpiXm-UE2s=GKFroTGczTr=ENczuAeiTCH6QwQ@mail.gmail.com>
	<344075933.20140203143339@figureone.com>
	<CAH8MpnkuFDNzYi4enqqtQcmis08LyTWojV3DZrc_Mwim=aqvRQ@mail.gmail.com>
	<CAH8MpnnXag49Yw9yE2p=+h3X2caz6wwfiT8kLf8H_WxrwtjVNw@mail.gmail.com>
	<CAEZPtU7CciuHS+TDRKWZitBnmuGT3EN8wNmz=dXoP92g8Bs7mw@mail.gmail.com>
	<617796370.20140204005840@cypressintegrated.com>
	<CAEZPtU4Ed5ZM_5veS41u=O26UvXnYCGS=XSDWaHJ5+7fJ6=+fw@mail.gmail.com>
	<52F098F7.7000901@lsces.co.uk>
	<CAEZPtU68J_r-GnnwyS1KryLm7nzmxqLz9KKuiNZ1Ygc2Zag85w@mail.gmail.com>
	<52F09D64.9020803@lsces.co.uk>
	<CAEZPtU4n_WnZHvU1GhDwF0jQPHKt=F9mqrYZTh9=58mE9Wz1Nw@mail.gmail.com>
	<52F0A501.8030105@lsces.co.uk>
	<CAEZPtU4N0eCQb8pXUxruovQytGazkjBaNU=ji5vxVxorBYJdDQ@mail.gmail.com>
	<52F0ACC6.8030409@lsces.co.uk>
	<CAEZPtU7djiCn3hH+gRcXJdeLgo=z-zEvD9FFQz-Zqekh=EWePw@mail.gmail.com>
	<1386084526.20140206011339@cypressintegrated.com>
Date: Thu, 6 Feb 2014 15:09:49 +0100
Message-ID: <CAH-PCH5nQwNq5J2+zxFbm3Yu6DhG52dz=rWs8Jd4_m0vHF4LoA@mail.gmail.com>
To: Sanford Whiteman <swhitemanlistens-software@cypressintegrated.com>
Cc: Pierre Joye <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c126622ef0ec04f1bd6d81
Subject: Re: [PHP-DEV] Re: Windows Peer Verification
From: tyra3l@gmail.com (Ferenc Kovacs)

--001a11c126622ef0ec04f1bd6d81
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Thu, Feb 6, 2014 at 7:13 AM, Sanford Whiteman <
swhitemanlistens-software@cypressintegrated.com> wrote:

> Hey Pierre, re: the script to download the trusted CA bundle, how do
> you propose to make *that* connection secure the first time?
>
> Not being facetious. I was convinced (albeit suddenly) by Padraic's
> argument that all fault for insecure remote transfers lies with the
> developer as long as secure options exist. How do we avoid being that
> same kind of developer? Neither plain-text download nor unverified TLS
> should be used for the trusted CA root list. The ability to tamper
> with that download would be catastrophic.
>
> If we can't ship the CA bundle and can't ship even the CA cert for the
> site we choose to deliver the bundle, I think it's better to give
> people the URL and tell them to use a browser (which will perform
> verification).
>
> I was poking around and noticed that Mono's CLI for fetching the CA
> bundle (in this case Mozilla's) uses a plain http:// URL. I find this
> to be rather bizarre under the circumstances.
> [http://linux.die.net/man/1/mozroots]
>
> -- S.
>
>
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
What Pierre is/was proposing is that we include the CA file to the windows
binary distribution, and we also include a script, which can
generate/download the same CA file, so if you don't trust us to sneak
something to the CA file, you can see for yourself, and also, when the
Windows team does the packaging, they would use the same script (executed
by a php installation already properly configured for ssl) to create the CA
file to be included to the binary release.
So this would serve more of a transparency purpose, than to provide a way
to the php installs without a CA file to get one(as you mentioned, that
would be a chicken/egg problem).

At least this is my understanding of the proposal (and if you remember, I'm
on the side of not shipping a CA file at all, but educating our users
where/how to get one).

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--001a11c126622ef0ec04f1bd6d81--