On 10/16/2015 12:24 AM, Jonathan Wilkes via Pd-dev wrote:
Oh, those are both absolutely insecure by default.
"both"?
You (and Sourceforge) default to insecure connections. Sourceforge only forces the encryption when the user needs to write something.
Nevertheless, I think it's cases like this one which "Let's Encrypt" is designed to solve. I'm happy to leave it to them to eventually lift the work you've done up into the 21st century.
rather than keep on ranting, you could have just cloned the repositories via https (after checking the BIG RED WARNING and assuring that it indeed is a valid certificate from a trusted party that just happens to use the wrong hostname) into your super-secret gitlab instance at OSUOSL which does everything better and not only uses cryptography but also 21st century steganography to protect everybody's privacy.
fgmard IOhannes