Re: downloading dek file: security risk

IOhannes m zmoelnig <[email protected]> Tue, 22 Oct 2024 09:50:31 +0200

Newsgroups	gmane.comp.multimedia.puredata.general
Message-ID	<[email protected]>

On 10/21/24 12:53, IOhannes m zmoelnig wrote:
> maybe, i'll implement something (there's already <https://git.iem.at/ 
> zmoelnig/deken-server/-/issues/7>), but i have no ETA.

i think i've fixed the issue now: whenever you access 
deken.puredata.info via https, you will now also get https:// links to 
the packages, so the security warning should now be void.

i also think i now know what caused the disturbance in the first place: 
about a month ago or so, our security adviser told me to tighten up 
security on our webservices. one of the things that changed is that we 
know use an HSTS header, indicating that browsers should always use 
https:// to access deken.puredata.info (while at the same time, allowing 
the content to be served over http://, so Pd/deken is still happy).
usually these headers are served over https:// (preventing a connection 
downgrade to http://), but we are using them on the http:// connection 
as well (nudging the browser to upgrade to https://)

long story short: i think we know have a working solution that uses 
https:// (both for searching an downloading) whenever possible, but 
still allows http:// access for legacy clients.

gfadmsr
IOhannes

---
[email protected] - the Pure Data mailinglist
https://lists.iem.at/hyperkitty/list/[email protected]/message/6HKM4M52IV62FQ2NWSUNCBO22ZWQGAUU/

To unsubscribe send an email to [email protected] mailing list
UNSUBSCRIBE and account-management -> https://lists.iem.at/

OpenPGP_signature.asc (application/pgp-signature, 840 B)