Oh wow, I guess it's been awhile since I've used Sourceforge. It looks like they just offer svn (which isn't secure) and http by default. Yikes. It's 2015. Users should get an encrypted connection to repos by default, no exceptions. It's extraordinary to me that you'd let the limitations of StartSSL's free cert dictate the security of your users. But if that really is the limiting factor, why can't you just wait half a year for EFF's "Let's Encrypt" project to ship? Then you can get certs for however many subdomains you want, and a whole class of potential attacks on your users will disappear. In the meantime, please don't teach users that it's ok to ignore basic internet security (plus the big, red browser warnings) just because you don't feel like paying money or asking one of many capable free-software organizations for help. -Jonathan
On Wednesday, October 14, 2015 2:11 PM, IOhannes m zmölnig zmoelnig@iem.at wrote:
On 10/14/2015 08:01 PM, Jonathan Wilkes via Pd-dev wrote:
As strongly and politely as I can advise: PLEASE don't pull until IOhannes implements SSL by default for these repos.
the only problem here is that my certificate is only valid for apt.puredata.info/puredata.info and *not* for git.puredata.info
if you can live with that, just use
https://git.puredata.info/cgit/svn2git/
gfmards IOhannes
_______________________________________________ Pd-dev mailing list Pd-dev@lists.iem.at http://lists.puredata.info/listinfo/pd-dev