Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87322
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.43 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CADNQb0Uu3-rvR-cX-JaRyqui7fPEeasD2=nSo++1BKUxd2VZOw@mail.gmail.com>
References: <CAH-PCH41UgBmJkvORS-7j5EETcxzkOCqrCX+h6mBvXZZDPaaUA@mail.gmail.com>
	<CADNQb0Uu3-rvR-cX-JaRyqui7fPEeasD2=nSo++1BKUxd2VZOw@mail.gmail.com>
Date: Mon, 27 Jul 2015 18:27:19 +0200
Message-ID: <CAH-PCH6-55CGzMV9LGW+LH5Z=tWzU7Hf19YHtmmLM8A6uH1h4g@mail.gmail.com>
To: Hannes Magnusson <bjori@php.net>
Cc: PHP Internals <internals@lists.php.net>, Stanislav Malyshev <stas@php.net>, julien pauli <jpauli@php.net>, 
	Kalle Sommer Nielsen <kalle@php.net>, Anatoliy Belsky <ab@php.net>
Content-Type: multipart/alternative; boundary=001a11c3cc6eda9938051bddd3ce
Subject: Re: use https when downloading the pear installer
From: tyra3l@gmail.com (Ferenc Kovacs)

--001a11c3cc6eda9938051bddd3ce
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Mon, Jul 27, 2015 at 5:46 PM, Hannes Magnusson <bjori@php.net> wrote:

> On Mon, Jul 27, 2015 at 12:32 AM, Ferenc Kovacs <tyra3l@gmail.com> wrote:
> > Hi,
> >
> > I've just realized that even thought https://pear.php.net/ is
> available, we
> > are still downloading the install-pear-nozlib.phar via http:// in
> > pear/Makefile.frag and makedist
> > Do you happen to know any reason for keeping it that way or is this onl=
y
> for
> > historical reasons (maybe pear.php.net did not have proper cert or
> > configured to accept traffic on 443 originally when the download proces=
s
> was
> > created) and should be ok to make this more secure(as it would prevent
> MITM
> > attacks).
> >
> > What do you think?
>
> I think nice catch *hat tip*.
>
> I'm pretty sure noone cared when this was written ~10 years ago -- we
> didn't even have any certificate issued, not even CAcert at that
> point.
>
>
> -Hannes
>

I will change it to https in master, and if nobody complains about it after
the next PHP7 beta/RC I will backport it to the lower branches.

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--001a11c3cc6eda9938051bddd3ce--