[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

bug#39419: On the use of HTTPS for substitute server

From: Damien Cassou
Subject: bug#39419: On the use of HTTPS for substitute server
Date: Tue, 04 Feb 2020 15:28:16 +0100

In the manual, section Package Management>Substitutes, I can read:

> Substitute URLs can be either HTTP or HTTPS. HTTPS is recommended
> because communications are encrypted; conversely, using HTTP makes all
> communications visible to an eavesdropper, who could use the information
> gathered to determine, for instance, whether your system has unpatched
> security vulnerabilities.

A few pages later, I read:

> When using HTTPS, the server’s X.509 certificate is _not_ validated
> (in other words, the server is not authenticated), contrary to what
> HTTPS clients such as Web browsers usually do.  This is because Guix
> authenticates substitute information itself, as explained above, which
> is what we care about (whereas X.509 certificates are about
> authenticating bindings between domain names and public keys.)

Doesn't the second paragraph contradict a bit the first? It seems to me
that not validating a server's certificate means the client is
vulnerable to a MITM attack where the attacker would know "whether your
system has unpatched security vulnerabilities".

Damien Cassou

"Success is the ability to go from one failure to another without
losing enthusiasm." --Winston Churchill

reply via email to

[Prev in Thread] Current Thread [Next in Thread]