Re: downloading dek file: security risk

@ IOhannes

in my case the fix works: no security warning anymore.

great service
rolf


IOhannes m zmoelnig schreef op 22-10-2024 9:50:
> On 10/21/24 12:53, IOhannes m zmoelnig wrote:
>> maybe, i'll implement something (there's already <https://git.iem.at/ 
>> zmoelnig/deken-server/-/issues/7>), but i have no ETA.
> 
> i think i've fixed the issue now: whenever you access
> deken.puredata.info via https, you will now also get https:// links to
> the packages, so the security warning should now be void.
> 
> i also think i now know what caused the disturbance in the first
> place: about a month ago or so, our security adviser told me to
> tighten up security on our webservices. one of the things that changed
> is that we know use an HSTS header, indicating that browsers should
> always use https:// to access deken.puredata.info (while at the same
> time, allowing the content to be served over http://, so Pd/deken is
> still happy).
> usually these headers are served over https:// (preventing a
> connection downgrade to http://), but we are using them on the http://
> connection as well (nudging the browser to upgrade to https://)
> 
> long story short: i think we know have a working solution that uses
> https:// (both for searching an downloading) whenever possible, but
> still allows http:// access for legacy clients.
> 
> gfadmsr
> IOhannes
> 
> ---
> [email protected] - the Pure Data mailinglist
> https://lists.iem.at/hyperkitty/list/[email protected]/message/6HKM4M52IV62FQ2NWSUNCBO22ZWQGAUU/
> 
> To unsubscribe send an email to [email protected] mailing list
> UNSUBSCRIBE and account-management -> https://lists.iem.at/

---
[email protected] - the Pure Data mailinglist
https://lists.iem.at/hyperkitty/list/[email protected]/message/IAQF7EWQN5BIOZKBSXTYTZIA3TOOBWAC/

To unsubscribe send an email to [email protected] mailing list
UNSUBSCRIBE and account-management -> https://lists.iem.at/