Re: com web/php: now that posttohost() supports ssl, we should use https here: git-php.php mailing-lists.php manual/add-note.php submit-event.php

On Sun, Sep 16, 2012 at 12:52 AM, Ferenc Kovacs <tyrael@php.net> wrote: > > > On Mon, Aug 6, 2012 at 10:12 AM, Hannes Magnusson > <hannes.magnusson@gmail.com> wrote: >> >> On Sun, Aug 5, 2012 at 11:11 PM, Ferenc Kovacs <tyrael@php.net> wrote: >> > >> > >> > On Sun, Aug 5, 2012 at 11:24 PM, Hannes Magnusson >> > <hannes.magnusson@gmail.com> wrote: >> >> >> >> On Sun, Aug 5, 2012 at 8:52 PM, Ferenc Kovacs <tyrael@php.net> wrote: >> >> > Commit: 1511842d066ec52fe4df34dde839f79a5653288d >> >> > Author: Ferenc Kovacs <tyra3l@gmail.com> Sun, 5 Aug 2012 >> >> > 21:52:37 +0200 >> >> > Parents: 855e5f7a7f479687dd265ad9f5140761c2a3f401 >> >> > Branches: master >> >> > >> >> > Link: >> >> > >> >> > >> >> > http://git.php.net/?p=web/php.git;a=commitdiff;h=1511842d066ec52fe4df34dde839f79a5653288d >> >> > >> >> > Log: >> >> > now that posttohost() supports ssl, we should use https here >> >> > >> >> >> >> Have you verified all mirrors have ext/openssl enabled? >> >> It needs to be an requirement if you need to change this. >> > >> > >> > I assumed that it is available, as Rasmus switched to https once in the >> > past >> > and only switched back to http as posttohost wasn't supporting https >> > (http://svn.php.net/viewvc?view=revision&revision=322565) which I fixed >> > recently. >> > Now that you mention it, we don't have that as a requirement on >> > http://www.php.net/mirroring.php so I guess there are >> > mirrors without >> > having >> > ssl support. >> > Is there any convinient way to verify this? >> >> >> Modify mirror-info.php[1], update the mirror-test[2] script.. and >> modify the MySQL table, and the mirror status listing scripts. >> >> -Hannes >> >> [1] >> >> http://git.php.net/?p=web/php.git;a=history;f=mirror-info.php;h=01fbec406ff5df61dc9edfaa2aa243cd496e15fa;hb=HEAD >> [2] >> >> http://git.php.net/?p=web/master.git;a=blob;f=scripts/mirror-test;h=465b9ef56303f2d119ff19ba2f5c879131a69c6b;hb=HEAD > > > the majority of the mirrors have openssl(87/100), but not all, here is the > list of mirrors without openssl: > at2.php.net > cn2.php.net > dk.php.net > de2.php.net > in2.php.net > ie.php.net > jp.php.net > pa.php.net > pt2.php.net > md.php.net > ro2.php.net > si2.php.net > tw.php.net > > Currently posttohost is used for the following scenarios: > > posting user note submissions to master > (http://master.php.net/entry/user-note.php) > posting mailing list subscriptions to master > (http://master.php.net/entry/subscribe.php) > posting event submissions to master (http://master.php.net/entry/event.php) > posting the account request submissions to master > (http://master.php.net/entry/svn-account.php) > > Sending the last one over http really worries me, so at least we should > force that to happen over https (either adding ssl to all mirrors, or > restricting/redirecting the account request to the mirrors with openssl). > What do you think? Nice. I wasn't expecting that many to have it enabled. Since there are so many I suppose we can make it an requirement and then switch over. Please coordinate with Daniel to get the rest of the mirrors running with ext/openssl and update the mirroring instructions. -Hannes