Oh wow, I guess it's been awhile since I've used Sourceforge. It looks like
they just offer svn (which isn't secure) and http by default. Yikes.
It's 2015. Users should get an encrypted connection to repos by default, no
exceptions.
It's extraordinary to me that you'd let the limitations of StartSSL's free cert
dictate the security of your users. But if that really is the limiting factor, why
can't you just wait half a year for EFF's "Let's Encrypt" project to ship? Then
you can get certs for however many subdomains you want, and a whole class
of potential attacks on your users will disappear.
In the meantime, please don't teach users that it's ok to ignore basic internet
security (plus the big, red browser warnings) just because you don't feel like paying money or asking one of many capable free-software organizations
for help.
-Jonathan
On Wednesday, October 14, 2015 2:11 PM, IOhannes m zmölnig <zmoelnig@iem.at> wrote:
On 10/14/2015 08:01 PM, Jonathan Wilkes via Pd-dev wrote:
> As strongly and politely as I can advise: PLEASE don't pull until IOhannes implements SSL by default for these repos.
the only problem here is that my certificate is only valid for
apt.puredata.info/puredata.info and *not* for git.puredata.info
if you can live with that, just use
https://git.puredata.info/cgit/svn2git/gfmards
IOhannes