4 ms·
Any predictions how much the usage of CURLOPT_SSL_VERIFYPEER, false will increase in the next 7 days?
by luckylion 6y ago
Any predictions how much the usage of CURLOPT_SSL_VERIFYPEER, false will increase in the next 7 days?
- gregmac 6y agoYikes.. yeah, if you're going to do this, consider wrapping it in an `if (date < 2020-06-15)` and be sure to fix it properly before then. This reduces the ability to just forget about it (or have the fix constantly deprioritized) and leave your software with a security vulnerablty.
- josephcsible 6y agoIMO, there's a bit of a design flaw with curl here. There should be an easy flag to say "trust the particular certificate with this hash, no matter what's wrong with it", but there isn't, so people instead use the one that says "trust whatever certificate you get, no matter what's wrong with it".
- user5994461 6y agoTrusting a specific hash would blow up when the service rotate its self-signed certificate, defeating the point of ignoring certificate error.
- josephcsible 6y agoIf you're rotating a self-signed certificate, then how do you suppose that clients securely trust it? Or if you just mean replacing it when it expires, then this could instead be tied to the underlying public key alone, which can be reused.
- pornel 6y agoIf your clients support "rotating" self-signed certs just like that, it's a huge MITM vulnerability and makes HTTPS as secure as a TSA checkpoint.
- elithrar 6y agoPredictions? https://github.com/search?o=desc&q=SSL+verify&s=committer-date&type=Commits https://github.com/search?o=desc&q=SSL+verify&s=committer-da... :)