4 ms·

I noticed the same thing, and filed an issue [1]. The first reply does not fill me with a lot of confidence (but it's unclear to me whether the person is affili

by gspr 6y ago

I noticed the same thing, and filed an issue [1]. The first reply does not fill me with a lot of confidence (but it's unclear to me whether the person is affiliated with the project or not). [1] https://github.com/signalapp/Signal-TLS-Proxy/issues/6 https://github.com/signalapp/Signal-TLS-Proxy/issues/6

aftbit 6y ago
They have completely disabled issues on that repository. Wow I used to really like Signal...
- kelnos 6y ago
  And it seems they've fixed the issue, without any kind of public comment.... still not great: https://github.com/signalapp/Signal-TLS-Proxy/commit/39a97dab729fd705445742c95d5dd77eb62109e8 https://github.com/signalapp/Signal-TLS-Proxy/commit/39a97da...
  - kdunglas 6y ago
    I (partially) fixed this issue, and I'm not affiliated in any way with Signal. It's public (https://github.com/signalapp/Signal-TLS-Proxy/pull/2 https://github.com/signalapp/Signal-TLS-Proxy/pull/2), and it looks like they welcome contributions, because they merged mine.
    - gspr 6y ago
      Sorry for not noticing your PR before filing the bug. I still find the way they (partially) dealt with this a bit worrisome.
    - cryo 6y ago
      Wouldn't it be saner to also verify the downloaded archive hash? It looks like the domain resolving of nginx.org is trusted without doubt.
      - kdunglas 6y ago
        Sure! I also opened another PR to check the archive signature: https://github.com/signalapp/Signal-TLS-Proxy/pull/10 https://github.com/signalapp/Signal-TLS-Proxy/pull/10