Re: Re: Windows Peer Verification

On Thu, Feb 6, 2014 at 7:13 AM, Sanford Whiteman < swhitemanlistens-software@cypressintegrated.com> wrote: > Hey Pierre, re: the script to download the trusted CA bundle, how do > you propose to make *that* connection secure the first time? > > Not being facetious. I was convinced (albeit suddenly) by Padraic's > argument that all fault for insecure remote transfers lies with the > developer as long as secure options exist. How do we avoid being that > same kind of developer? Neither plain-text download nor unverified TLS > should be used for the trusted CA root list. The ability to tamper > with that download would be catastrophic. > > If we can't ship the CA bundle and can't ship even the CA cert for the > site we choose to deliver the bundle, I think it's better to give > people the URL and tell them to use a browser (which will perform > verification). > > I was poking around and noticed that Mono's CLI for fetching the CA > bundle (in this case Mozilla's) uses a plain http:// URL. > I find this > to be rather bizarre under the circumstances. > [http://linux.die.net/man/1/mozroots] > > -- S. > > > > -- > PHP Internals - PHP Runtime Development Mailing List > To unsubscribe, visit: http://www.php.net/unsub.php > > What Pierre is/was proposing is that we include the CA file to the windows binary distribution, and we also include a script, which can generate/download the same CA file, so if you don't trust us to sneak something to the CA file, you can see for yourself, and also, when the Windows team does the packaging, they would use the same script (executed by a php installation already properly configured for ssl) to create the CA file to be included to the binary release. So this would serve more of a transparency purpose, than to provide a way to the php installs without a CA file to get one(as you mentioned, that would be a chicken/egg problem). At least this is my understanding of the proposal (and if you remember, I'm on the side of not shipping a CA file at all, but educating our users where/how to get one). -- Ferenc Kovács @Tyr43l - http://tyrael.hu