Re: Making www.cpan.org TLS-only

[email protected] (David Golden) Mon, 4 Sep 2017 14:20:06 -0400

Newsgroups	perl.cpan.workers
Message-ID	<CAOeq1c_5pGVdJE3c9qMBhPxWgWMV-YjtxD+=QCCECP=z-eV9tA@mail.gmail.com>

On Thu, Aug 31, 2017 at 9:10 PM, Ask Bjørn Hansen <[email protected]> wrote:

> Hi everyone,
>
> We’re considering how/how-much we can make www.cpan.org TLS-only.
> http://log.perl.org/2017/08/tls-only-for-wwwcpanorg.html
>
> I expect that we can’t make the whole site TLS-only without breaking some
> CPAN clients, so the conservative version is to force TLS for
>
> - any url ending in *.html
> - any url not in matching some variation of
>      (/authors/ | /MIRRORED.BY | ^/modules/[^/]+ )
>
> Does that sound about right? Maybe /src/, too?
>
>
>
Are those "OR" conditions?  "*.html" OR not in /authors/, etc/?

Among things that should allow non-TLS: I would include /src/.  Also the
top-level RECENT files, things in /indices/.

David



-- 
David Golden <[email protected]> Twitter/IRC/GitHub: @xdg