3 ms·
I am amused that the examples on the README are all https, where gosh wouldn't be needed in the first place.
by aboodman 16y ago
I am amused that the examples on the README are all https, where gosh wouldn't be needed in the first place.
- sbierwagen 16y agoUnless your tinfoil hat is nailed firmly to your head, and you're worried about state-sponsored CA attacks that break HTTPS; or if you're running code from a site you don't trust, for... some reason.
- wladimir 16y agoNo tinfoil hat needed here. Not only states can compromise CAs, scriptkiddies and hackers can too. As every CA can produce a certificate for every site, only one has to be weak/exploitable and you're screwed. HTTPS is no replacement for proper code signing and checking. The hacker of the latest CA fiasco also produced a certificate for "plugins.mozilla.org", for example.
- NateLawson 16y agoHowever, less funny is that curl doesn't work with https without a lengthy process of creating a CA bundle from Mozilla. This process happens to be much harder than installing a proper package manager that supports signed packages.