Qake: GNU Make-based build system with a different approach • Hacker News Board

Re: Qake: GNU Make-based build system with a different approach

#31

Post by nmcfarl » Tue, Nov 04, 2014, 3:14 PM UTC

colechristensen wrote: post #16

nmcfarl wrote: post #8

Earlier quoted context omitted.

It's a self-signed cert - and just as encrypted as it would be with a traditionally signed cert. This is the half of SSL that I care about - I really don't care if you handed your money over to some organization that verified you have a working phone number. -- Actually it doesn’t appear to be a self-signed cert in this case - or even necessary. That cert is playing fine with both safari, and GNU Wget 1.14.

When you're installing software from https, you're not trying to make sure nobody can see the contents of the message (it's publicly available), you're trying to ensure that there's no man in the middle tampering with your software en route. A self signed cert which you can't independently verify is entirely worthless in this context. A man in the middle could simply substitute his own self signed cert and you'd be n…

So the argument here is that we are trusting github not the author of the software. And that way we can trust the code audit we do on GitHub to be the same as the downloaded software. So we don't have to use our own software tools to do that audit, we can look at the code on github.

I can see that being a valid argument for github however for self-hosted non-famous authors the fact that they are who they say they are means nothing to me°. And as such I'm going to have to audit the software on my box regardless. (Or just forget about auditing and trust of the world is a safe place - which is what most people do anyhow - and if you are doing that you don't believe in mitm's anyhow.)

°also I would argue that they signed certificate doesn't prove that anyhow. And state actors can forge these anyhow, so we are now talking about people who control your pipes, but not the government, and who hasn't hacked the end point. And

Re: Qake: GNU Make-based build system with a different approach

#32

Post by colechristensen » Tue, Nov 04, 2014, 3:39 PM UTC

nmcfarl wrote: post #31

colechristensen wrote: post #16

Earlier quoted context omitted.

When you're installing software from https, you're not trying to make sure nobody can see the contents of the message (it's publicly available), you're trying to ensure that there's no man in the middle tampering with your software en route. A self signed cert which you can't independently verify is entirely worthless in this context. A man in the middle could simply substitute his own self signed cert and you'd be n…

So the argument here is that we are trusting github not the author of the software. And that way we can trust the code audit we do on GitHub to be the same as the downloaded software. So we don't have to use our own software tools to do that audit, we can look at the code on github. I can see that being a valid argument for github however for self-hosted non-famous authors the fact that they are who they say they are…

The point is, if you don't verify ssl certificates, you might as well use http. Https with self signed certs provides you no security in any circumstances downloading public software.

Self-signed certificates and http connections are trivially intercepted and forged (ever used wifi in a public place?)

Signed certificates provide limited proof of identity true, but they can't be forged by jokers hijacking the wifi in a coffee shop.

Re: Qake: GNU Make-based build system with a different approach

#33

Post by [deleted] » Tue, Nov 04, 2014, 3:47 PM UTC

colechristensen wrote: post #32

nmcfarl wrote: post #31

Earlier quoted context omitted.

So the argument here is that we are trusting github not the author of the software. And that way we can trust the code audit we do on GitHub to be the same as the downloaded software. So we don't have to use our own software tools to do that audit, we can look at the code on github. I can see that being a valid argument for github however for self-hosted non-famous authors the fact that they are who they say they are…

The point is, if you don't verify ssl certificates, you might as well use http. Https with self signed certs provides you no security in any circumstances downloading public software. Self-signed certificates and http connections are trivially intercepted and forged (ever used wifi in a public place?) Signed certificates provide limited proof of identity true, but they can't be forged by jokers hijacking the wifi in…

[deleted]