From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 20742 invoked by alias); 15 Mar 2019 12:25:30 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 20725 invoked by uid 89); 15 Mar 2019 12:25:29 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-2.7 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_LOW autolearn=ham version=3.3.1 spammy=equally, brian, Brian, downloading X-HELO: smtp-out-so.shaw.ca Received: from smtp-out-so.shaw.ca (HELO smtp-out-so.shaw.ca) (64.59.136.138) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Fri, 15 Mar 2019 12:25:28 +0000 Received: from [192.168.1.114] ([24.64.172.44]) by shaw.ca with ESMTP id 4ltshR9H5o7SQ4ltth0Dgp; Fri, 15 Mar 2019 06:25:26 -0600 From: Brian Inglis Subject: Re: SSL not required for setup.exe download Reply-To: Brian.Inglis@SystematicSw.ab.ca To: "cygwin@cygwin.com" References: <1a840c2e-55ac-0ab4-66c4-a1f6a2c4f81a@Shaw.ca> <41f12842-ea43-ff63-a660-26ee3b497c63@SystematicSw.ab.ca> <1b570593-0ec7-0890-26ef-7e7468534f47@SystematicSw.ab.ca> Openpgp: preference=signencrypt Message-ID: Date: Fri, 15 Mar 2019 12:25:00 -0000 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-IsSubscribed: yes X-SW-Source: 2019-03/txt/msg00400.txt.bz2 On 2019-03-12 08:58, Archie Cobbs wrote: > On Tue, Mar 12, 2019 at 9:32 AM Brian Inglis wrote: >>> OTOH, if you download the file over HTTPS.. then your client supports >>> SSL. Which is exactly what I'm saying should be mandatory. >> Forcing TLS means blocking anyone who for any reason can not use TLS: this is a >> performance and support burden compared to allowing both HTTP:80 and HTTPS:443. > OK. Personally I have trouble believing any such person exists. That > is, a person who has access to an HTTP client, but not an HTTPS > client, for the one-time operation of downloading setup.exe. What are > they using, a TRS-80? I never said it was a person nor that they did not have access to a TLS client. I said they could not use a TLS client, which could be because of platform deficiencies, corporate policies, proxies, firewalls, security products. Systems or images older than a year may need the new root CA installed - some enterprises are very selective about including support for anything in their images - and users may not have root CA store access. I have systems which can support only original SSL not TLS - good luck using HTTPS to or from them, without using equally old software or libraries! > Anyway no worries, I'm giving up on this issue. Too much inertia around here. Perhaps just a desire not to break users access based om a wider understanding and experience of the variety across the complete ecosystem in which the projects are used, not just folks using modern desktop GUIs with no system or network access policies or restrictions. -- Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada This email may be disturbing to some readers as it contains too much technical detail. Reader discretion is advised. -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple