Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87321
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.169 as permitted sender)
MIME-Version: 1.0
Sender: hannes.magnusson@gmail.com
In-Reply-To: <CAH-PCH41UgBmJkvORS-7j5EETcxzkOCqrCX+h6mBvXZZDPaaUA@mail.gmail.com>
References: <CAH-PCH41UgBmJkvORS-7j5EETcxzkOCqrCX+h6mBvXZZDPaaUA@mail.gmail.com>
Date: Mon, 27 Jul 2015 08:46:23 -0700
Message-ID: <CADNQb0Uu3-rvR-cX-JaRyqui7fPEeasD2=nSo++1BKUxd2VZOw@mail.gmail.com>
To: Ferenc Kovacs <tyra3l@gmail.com>
Cc: PHP Internals <internals@lists.php.net>, Stanislav Malyshev <stas@php.net>, julien pauli <jpauli@php.net>, 
	Kalle Sommer Nielsen <kalle@php.net>, Anatoliy Belsky <ab@php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: use https when downloading the pear installer
From: bjori@php.net (Hannes Magnusson)

On Mon, Jul 27, 2015 at 12:32 AM, Ferenc Kovacs <tyra3l@gmail.com> wrote:
> Hi,
>
> I've just realized that even thought https://pear.php.net/ is available, we
> are still downloading the install-pear-nozlib.phar via http:// in
> pear/Makefile.frag and makedist
> Do you happen to know any reason for keeping it that way or is this only for
> historical reasons (maybe pear.php.net did not have proper cert or
> configured to accept traffic on 443 originally when the download process was
> created) and should be ok to make this more secure(as it would prevent MITM
> attacks).
>
> What do you think?

I think nice catch *hat tip*.

I'm pretty sure noone cared when this was written ~10 years ago -- we
didn't even have any certificate issued, not even CAcert at that
point.


-Hannes