4 ms·

> Cargo couldn’t fetch the index from crates.io if you were using an older Windows without having applied security fixes. Why are developers (since this is an

> Cargo couldn’t fetch the index from crates.io if you were using an older Windows without having applied security fixes. Why are developers (since this is an issue that shows up with cargo) running Windows 7 without security patches installed? Especially since the issue only shows up on Windows 7 installs that haven't received security patches since June 2016. > libgit2 created a fix, using the WinHTTP API to request TLS 1.2. On master, we’ve updated to fix this, but for 1.24.1 stable, we’re issuing a warning, suggesting that they upgrade their Windows version. That's really a neat and responsible way of handling this.

mtgx 9y ago
Although developers should know and do better, I think a big part of why they aren't doing it is because Microsoft has made it so hard to update Windows 7 since a year or two ago, all in the name of forcing people to switch to Windows 10. You now have to visit and manually download the updates from Microsoft's Update Catalog website. Oh, and that website only works on Internet Explorer.
- Arnavion 9y ago
  No idea what you mean. Windows 7 receives updates from Microsoft through Windows Update just fine.
- oblio 9y ago
  Are you sure about that? I know plenty of people with Windows 7 that just get updates through the normal channels.
- ndh2 9y ago
  Windows Update generally still works on 7. Maybe you ran into this issue? https://www.myce.com/news/windows-7-dont-receive-security-updates-without-antivirus-scanner-83815/ https://www.myce.com/news/windows-7-dont-receive-security-up...
ogoffart 9y ago
Speculating here: Maybe developers are testing/debugging on some VM with older Windows, without that machine be their development machine.
mstade 9y ago
> Why are developers (since this is an issue that shows up with cargo) running Windows 7 without security patches installed? Especially since the issue only shows up on Windows 7 installs that haven't received security patches since June 2016. Enterprise. It’s only recently I’ve stopped seeing XP boxes around, but Windows 7 is everywhere.
- oblio 9y ago
  Even in Enterprise environments, having boxes which haven't gotten security patches from 2 years ago is just careless.
  - mstade 9y ago
    Oh please don’t for a second believe I excuse this behavior in any way. I 100% agree with you, yet at the same time that is the reality you have to adjust to at times. Enterprise IT often moves at glacial speeds, and that’s on a good day...
Arnavion 9y ago
>Why are developers (since this is an issue that shows up with cargo) running Windows 7 without security patches installed? Especially since the issue only shows up on Windows 7 installs that haven't received security patches since June 2016. The issue shows up on patched machines. The patch does not enable TLS 1.2 by default. You have to add reg keys for it. https://github.com/rust-lang/cargo/issues/5065#issuecomment-367942576 https://github.com/rust-lang/cargo/issues/5065#issuecomment-...
- amluto 9y ago
  I've never understood why Microsoft adds support for new crypto protocols but turns them off by default.
  - colejohnson66 9y ago
    To avoid breaking badly designed programs?
  - Arnavion 9y ago
    (To be clear, Windows 7 without the patch also supports TLS 1.2. The patch adds a registry key to configure the default protocols for applications that don't explicitly override the default.)

mtgx 9y ago

Although developers should know and do better, I think a big part of why they aren't doing it is because Microsoft has made it so hard to update Windows 7 since a year or two ago, all in the name of forcing people to switch to Windows 10. You now have to visit and manually download the updates from Microsoft's Update Catalog website. Oh, and that website only works on Internet Explorer.

Arnavion 9y ago
No idea what you mean. Windows 7 receives updates from Microsoft through Windows Update just fine.
oblio 9y ago
Are you sure about that? I know plenty of people with Windows 7 that just get updates through the normal channels.
ndh2 9y ago
Windows Update generally still works on 7. Maybe you ran into this issue? https://www.myce.com/news/windows-7-dont-receive-security-updates-without-antivirus-scanner-83815/ https://www.myce.com/news/windows-7-dont-receive-security-up...

ogoffart 9y ago

Speculating here: Maybe developers are testing/debugging on some VM with older Windows, without that machine be their development machine.

mstade 9y ago

> Why are developers (since this is an issue that shows up with cargo) running Windows 7 without security patches installed? Especially since the issue only shows up on Windows 7 installs that haven't received security patches since June 2016. Enterprise. It’s only recently I’ve stopped seeing XP boxes around, but Windows 7 is everywhere.

oblio 9y ago
Even in Enterprise environments, having boxes which haven't gotten security patches from 2 years ago is just careless.
- mstade 9y ago
  Oh please don’t for a second believe I excuse this behavior in any way. I 100% agree with you, yet at the same time that is the reality you have to adjust to at times. Enterprise IT often moves at glacial speeds, and that’s on a good day...

Arnavion 9y ago

>Why are developers (since this is an issue that shows up with cargo) running Windows 7 without security patches installed? Especially since the issue only shows up on Windows 7 installs that haven't received security patches since June 2016. The issue shows up on patched machines. The patch does not enable TLS 1.2 by default. You have to add reg keys for it. https://github.com/rust-lang/cargo/issues/5065#issuecomment-367942576 https://github.com/rust-lang/cargo/issues/5065#issuecomment-...

amluto 9y ago
I've never understood why Microsoft adds support for new crypto protocols but turns them off by default.
- colejohnson66 9y ago
  To avoid breaking badly designed programs?
- Arnavion 9y ago
  (To be clear, Windows 7 without the patch also supports TLS 1.2. The patch adds a registry key to configure the default protocols for applications that don't explicitly override the default.)