GNU bug report logs

#22883 Trustable "guix pull"

PackageSource(s)Maintainer(s)
guix PTS Buildd Popcon
Full log

Message #37 received at 22883@debbugs.gnu.org (full text, mbox, reply):

Received: (at 22883) by debbugs.gnu.org; 17 May 2016 21:19:31 +0000
From debbugs-submit-bounces@debbugs.gnu.org Tue May 17 17:19:31 2016
Received: from localhost ([127.0.0.1]:56325 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1b2mOo-000137-Rv
	for submit@debbugs.gnu.org; Tue, 17 May 2016 17:19:30 -0400
Received: from eggs.gnu.org ([208.118.235.92]:53588)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <ludo@gnu.org>) id 1b2mOk-00012s-AH
 for 22883@debbugs.gnu.org; Tue, 17 May 2016 17:19:29 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <ludo@gnu.org>) id 1b2mOc-0004Xs-31
 for 22883@debbugs.gnu.org; Tue, 17 May 2016 17:19:21 -0400
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=-3.3 required=5.0 tests=BAYES_00,RP_MATCHES_RCVD
 autolearn=disabled version=3.3.2
Received: from fencepost.gnu.org ([2001:4830:134:3::e]:58277)
 by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from <ludo@gnu.org>)
 id 1b2mOc-0004Xn-0P; Tue, 17 May 2016 17:19:18 -0400
Received: from reverse-83.fdn.fr ([80.67.176.83]:48816 helo=pluto)
 by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_128_CBC_SHA1:128)
 (Exim 4.82) (envelope-from <ludo@gnu.org>)
 id 1b2mOb-0005R9-6h; Tue, 17 May 2016 17:19:17 -0400
From: ludo@gnu.org (Ludovic Courtès)
To: fluxboks@openmailbox.org
Subject: Re: bug#22883: Trustable "guix pull"
References: <87io14sqoa.fsf@dustycloud.org>
 <c9f22542d79aaf0503b68ba70f0ce912@openmailbox.org>
X-URL: http://www.fdn.fr/~lcourtes/
X-Revolutionary-Date: 29 Floréal an 224 de la Révolution
X-PGP-Key-ID: 0x090B11993D9AEBB5
X-PGP-Key: http://www.fdn.fr/~lcourtes/ludovic.asc
X-PGP-Fingerprint: 3CE4 6455 8A84 FDC6 9DB4  0CFB 090B 1199 3D9A EBB5
X-OS: x86_64-unknown-linux-gnu
Date: Tue, 17 May 2016 23:19:15 +0200
In-Reply-To: <c9f22542d79aaf0503b68ba70f0ce912@openmailbox.org>
 (fluxboks@openmailbox.org's message of "Sun, 15 May 2016 15:40:49
 +0300")
Message-ID: <87oa84v0vg.fsf@gnu.org>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
X-Received-From: 2001:4830:134:3::e
X-Spam-Score: -6.4 (------)
X-Debbugs-Envelope-To: 22883
Cc: 22883@debbugs.gnu.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -6.4 (------)
Hi!

fluxboks@openmailbox.org skribis:

> But I presume there must be another reason why there's no https,

HTTPS is not the alpha and omega of security.  At best, it provides
confidentiality and allows users to authenticate the server (some
certificate authorities are corrupt though, so there’s a risk.)

Once you’ve authenticated the server, you still haven’t authenticated
the code, which is what you’re really interested in as a user.

So this is what this issue is about, and I agree it needs to be fixed
ASAP.  Your contributions are very welcome, too!  :-)

Ludo’.




Send a report that this bug log contains spam.


debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 01:05:43 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.