3 ms·
I (partially) fixed this issue, and I'm not affiliated in any way with Signal. It's public (https://github.com/signalapp/Signal-TLS-Proxy/pull/2 https://github.
by kdunglas 6y ago
I (partially) fixed this issue, and I'm not affiliated in any way with Signal. It's public (https://github.com/signalapp/Signal-TLS-Proxy/pull/2 https://github.com/signalapp/Signal-TLS-Proxy/pull/2), and it looks like they welcome contributions, because they merged mine.
- gspr 6y agoSorry for not noticing your PR before filing the bug. I still find the way they (partially) dealt with this a bit worrisome.
- cryo 6y agoWouldn't it be saner to also verify the downloaded archive hash? It looks like the domain resolving of nginx.org is trusted without doubt.
- kdunglas 6y agoSure! I also opened another PR to check the archive signature: https://github.com/signalapp/Signal-TLS-Proxy/pull/10 https://github.com/signalapp/Signal-TLS-Proxy/pull/10