Re: svn: /web/php-master/trunk/include/ functions.inc

On Wed, Mar 23, 2011 at 3:03 PM, Hannes Magnusson < hannes.magnusson@gmail.com> wrote: > On Wed, Mar 23, 2011 at 14:52, Ferenc Kovacs <info@tyrael.hu> wrote: > > On Wed, Mar 23, 2011 at 2:26 PM, Richard Quadling <rquadling@gmail.com > >wrote: > > > >> On 23 March 2011 13:14, Hannes Magnusson <bjori@php.net> wrote: > >> > bjori Wed, 23 Mar 2011 13:14:34 > +0000 > >> > > >> > Revision: > >> > http://svn.php.net/viewvc?view=revision&revision=309599 > >> > > >> > Log: > >> > Prettify, and advocate https until we kill http > >> > > >> > Changed paths: > >> > U web/php-master/trunk/include/functions.inc > >> > > >> > Modified: web/php-master/trunk/include/functions.inc > >> > =================================================================== > >> > --- web/php-master/trunk/include/functions.inc 2011-03-23 13:14:12 > UTC > >> (rev 309598) > >> > +++ web/php-master/trunk/include/functions.inc 2011-03-23 13:14:34 > UTC > >> (rev 309599) > >> > @@ -34,9 +34,15 @@ > >> > <li><a > >> > href="http://wiki.php.net/">Wiki</a></li> > >> > <li><a > >> > href="http://bugs.php.net/">Bugsweb</a></li> > >> > </ul> > >> > - <h2>Have you changed your password yet?</h2> > >> > <?php > >> > +if (!isset($_SERVER["HTTPS"]) || $_SERVER["HTTPS"] != > >> > "on") { > >> > + warn("Why are you not using https?"); > >> > +} else { > >> > + warn("Have you changed your password yet?"); > >> > } > >> > +?> > >> > +<?php > >> > +} > >> > > >> > function foot() { > >> > echo "</body></html>"; > >> > > >> > > >> > -- > >> > PHP Webmaster List Mailing List (http://www.php.net/) > >> > To unsubscribe, visit: > >> > http://www.php.net/unsub.php > >> > > >> > >> Using Google Chrome and IE on windows complains about the SSL cert. > >> > >> IE's recommendation is "We recommend that you close this webpage and > >> do not continue to this website." > >> > >> Which is nicely severe. > >> > >> Examining the cert ... > >> > >> "This certificate cannot be verified up to a trusted certification > >> authority." > >> > >> I don't normally bother with the error. It is only with regard to the > >> recent breach that I'm raising this point. > >> > >> If https is being enforced, then not having a valid cert would > >> certainly seem to be an issue. > >> > >> -- > >> Richard Quadling > >> Twitter : EE : Zend > >> @RQuadling : e-e.com/M_248814.html : bit.ly/9O8vFY > >> > >> -- > >> PHP Webmaster List Mailing List (http://www.php.net/) > >> To unsubscribe, visit: http://www.php.net/unsub.php > >> > >> > > if the money is the problem for getting decent(from a CA supported by the > > major browsers, etc) ssl certs, then you should check out the free plan > from > > startssl, or ask for donations. > > self-signed ssl sucks from the security point of view (you can't be sure > > that you are seeing the warning because somebody man-in-the-middle you, > or > > the cert changed on the host, or that you visiting the site for the first > > time, and didn't added to the trusted certs yet). > > > > > Its not self-signed. Its a cert from CACert.org. > > > -Hannes > I don't want to repeat myself, but: https://twitter.com/#!/Tyr43l/status/23784829891911680 https://twitter.com/#!/Tyr43l/status/23794710518697984 wiki.php.net was using a self-signed cert. and as I said, the cacert cert has the same problems that I mentioned (except if the root cert is installed by default on the client, if I remember correctly debian ships it with ca-certificates) Tyrael