Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87314
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.53 as permitted sender)
MIME-Version: 1.0
Date: Mon, 27 Jul 2015 09:32:15 +0200
Message-ID: <CAH-PCH41UgBmJkvORS-7j5EETcxzkOCqrCX+h6mBvXZZDPaaUA@mail.gmail.com>
To: PHP Internals <internals@lists.php.net>, Stanislav Malyshev <stas@php.net>, julien pauli <jpauli@php.net>, 
	Kalle Sommer Nielsen <kalle@php.net>, Anatoliy Belsky <ab@php.net>, Hannes Magnusson <bjori@php.net>
Content-Type: multipart/alternative; boundary=001a11c25f5246ee3b051bd65a2a
Subject: use https when downloading the pear installer
From: tyra3l@gmail.com (Ferenc Kovacs)

--001a11c25f5246ee3b051bd65a2a
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi,

I've just realized that even thought https://pear.php.net/ is available, we
are still downloading the install-pear-nozlib.phar via http:// in
pear/Makefile.frag and makedist
Do you happen to know any reason for keeping it that way or is this only
for historical reasons (maybe pear.php.net did not have proper cert or
configured to accept traffic on 443 originally when the download process
was created) and should be ok to make this more secure(as it would prevent
MITM attacks).

What do you think?

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--001a11c25f5246ee3b051bd65a2a--