<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1444849428759_3521"><span id="yui_3_16_0_1_1444849428759_3750">Oh wow, I guess it's been awhile since I've used Sourceforge. It looks like </span></div><div id="yui_3_16_0_1_1444849428759_3521" dir="ltr"><span id="yui_3_16_0_1_1444849428759_3960">they just offer svn (which isn't secure) and http by default. Yikes.</span></div><div id="yui_3_16_0_1_1444849428759_3521" dir="ltr"><br></div><div id="yui_3_16_0_1_1444849428759_3521" dir="ltr">It's 2015. Users should get an encrypted connection to repos by default, no </div><div id="yui_3_16_0_1_1444849428759_3521" dir="ltr">exceptions.</div><div id="yui_3_16_0_1_1444849428759_3521" dir="ltr"><br></div><div id="yui_3_16_0_1_1444849428759_3521" dir="ltr">It's extraordinary to me that you'd let the limitations of StartSSL's free cert </div><div id="yui_3_16_0_1_1444849428759_3521" dir="ltr">dictate the security of your users. But if that really is the limiting factor, why </div><div id="yui_3_16_0_1_1444849428759_3521" dir="ltr">can't you just wait half a year for EFF's "Let's Encrypt" project to ship? Then </div><div id="yui_3_16_0_1_1444849428759_3521" dir="ltr">you can get certs for however many subdomains you want, and a whole class </div><div id="yui_3_16_0_1_1444849428759_3521" dir="ltr">of potential attacks on your users will disappear.</div><div id="yui_3_16_0_1_1444849428759_3521" dir="ltr"><br></div><div id="yui_3_16_0_1_1444849428759_3521" dir="ltr">In the meantime, please don't teach users that it's ok to ignore basic internet </div><div id="yui_3_16_0_1_1444849428759_3521" dir="ltr">security (plus the big, red browser warnings) just because you don't feel like paying money or asking one of many capable free-software organizations </div><div id="yui_3_16_0_1_1444849428759_3521" dir="ltr">for help.</div><div id="yui_3_16_0_1_1444849428759_3521" dir="ltr"><br></div><div id="yui_3_16_0_1_1444849428759_3521" dir="ltr">-Jonathan</div> <br><div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"> <font size="2" face="Arial"> On Wednesday, October 14, 2015 2:11 PM, IOhannes m zmölnig <zmoelnig@iem.at> wrote:<br> </font> </div> <br><br> <div class="y_msg_container">On 10/14/2015 08:01 PM, Jonathan Wilkes via Pd-dev wrote:<br clear="none">> As strongly and politely as I can advise: PLEASE don't pull until IOhannes implements SSL by default for these repos.<br clear="none"><br clear="none">the only problem here is that my certificate is only valid for<br clear="none">apt.puredata.info/puredata.info and *not* for git.puredata.info<br clear="none"><br clear="none">if you can live with that, just use<br clear="none"><br clear="none"> <a shape="rect" href="https://git.puredata.info/cgit/svn2git/" target="_blank">https://git.puredata.info/cgit/svn2git/</a><br clear="none"><br clear="none">gfmards<div class="yqt1209662575" id="yqtfd87970"><br clear="none">IOhannes<br clear="none"></div><br><div class="yqt1209662575" id="yqtfd86503">_______________________________________________<br clear="none">Pd-dev mailing list<br clear="none"><a shape="rect" ymailto="mailto:Pd-dev@lists.iem.at" href="mailto:Pd-dev@lists.iem.at">Pd-dev@lists.iem.at</a><br clear="none"><a shape="rect" href="http://lists.puredata.info/listinfo/pd-dev" target="_blank">http://lists.puredata.info/listinfo/pd-dev</a><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>