Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87340
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain schlueters.de from 217.114.215.10 cause and error)
Message-ID: <1438094723.27690.4.camel@kuechenschabe>
To: Ferenc Kovacs <tyra3l@gmail.com>
Cc: PHP Internals <internals@lists.php.net>, Stanislav Malyshev
 <stas@php.net>,  julien pauli <jpauli@php.net>, Kalle Sommer Nielsen
 <kalle@php.net>, Anatoliy Belsky <ab@php.net>, Hannes Magnusson
 <bjori@php.net>
Date: Tue, 28 Jul 2015 16:45:23 +0200
In-Reply-To: <CAH-PCH41UgBmJkvORS-7j5EETcxzkOCqrCX+h6mBvXZZDPaaUA@mail.gmail.com>
References: 
	<CAH-PCH41UgBmJkvORS-7j5EETcxzkOCqrCX+h6mBvXZZDPaaUA@mail.gmail.com>
Content-Type: multipart/signed; micalg="pgp-sha1"; protocol="application/pgp-signature";
	boundary="=-1esEY2RN6i1SAJRLpuJA"
Mime-Version: 1.0
Subject: Re: [PHP-DEV] use https when downloading the pear installer
From: johannes@schlueters.de (Johannes =?ISO-8859-1?Q?Schl=FCter?=)

--=-1esEY2RN6i1SAJRLpuJA
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, 2015-07-27 at 09:32 +0200, Ferenc Kovacs wrote:
> Hi,
>=20
> I've just realized that even thought https://pear.php.net/ is available, =
we
> are still downloading the install-pear-nozlib.phar via http:// in
> pear/Makefile.frag and makedist
> Do you happen to know any reason for keeping it that way or is this only
> for historical reasons (maybe pear.php.net did not have proper cert or
> configured to accept traffic on 443 originally when the download process
> was created) and should be ok to make this more secure(as it would preven=
t
> MITM attacks).

To evaluate the impact:

Yes, https is better but shouldn't really matter. End-users shouldn't do
this. The release script downloads it and the RM should verify it. Only
case where the Makefile.frag should trigger the download is for git
users bu they should be few and cautious.

(and yes - developers doing this might be an interesting targeted attack
vector. Malicious code there knows where the developer keeps the source
tree and might inject bad code into the codebase which we notice only
with good review of commits ... which we hopefully do ;-) )

johannes


--=-1esEY2RN6i1SAJRLpuJA
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQEcBAABAgAGBQJVt5WDAAoJEH3sTmn8nIPXls0IANuloDeIzzJ5UyCj9oewAmJP
811ZfijO27krnlEev8XsWGetLnRpWIBfIoXkMbtCqO1JsGvAzEPoPvOVHMAzQ2UC
tqR439KcLiO6vsM18dkCnkmopcokX51NBVvCSafZi6pNGKSvz10tDMbItrsknSiu
VvBlxGhKEHwufvjzM0n0S9ClPiGcT1F2PZO20t8393cuG4zwlZXDEjJVPeqmeGMw
Kv3PZPqlIKJBx5arT9YGsqED0wPd/s0irWPRJ1QpzywhDMZFZKEbqlKHpNoQXT77
M2xqiWfnEOn/bAp7Sna1sMMLYCODLmH22w/lFPF66t9IPrWcuOpZD5K4PHgSh2o=
=W+wO
-----END PGP SIGNATURE-----

--=-1esEY2RN6i1SAJRLpuJA--