Re: sponsor logo on home of CPAN mirror

--001a1135c59482cd6305619e8e0c
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Encouraging mirrors to inject code is a very bad idea from a security
perspective.  I agree with Ask that allowing them to inject config is safer
but is still a slippery slope.

On Sat, Dec 30, 2017 at 9:58 PM, Ask Bj=C3=B8rn Hansen <[email protected]> wrote=
:

> Rather than having it execute javascript that=E2=80=99s locally modified,=
 maybe we
> could have it just load some JSON?
>
> I know that the mirror can technically change anything, so this is not
> really a technical argument.
>
> I think it=E2=80=99s important to maintain a stance that it=E2=80=99s una=
cceptable to
> change anything (other than this=E2=80=A6). Changing a bit of meta data (=
a JSON
> file) seems less slippery slope than changing a bit of website code.
>
>
> Ask

--001a1135c59482cd6305619e8e0c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Encouraging mirrors to inject code is a very bad idea from=
 a security perspective.=C2=A0 I agree with Ask that allowing them to injec=
t config is safer but is still a slippery slope.</div><div class=3D"gmail_e=
xtra"><br><div class=3D"gmail_quote">On Sat, Dec 30, 2017 at 9:58 PM, Ask B=
j=C3=B8rn Hansen <span dir=3D"ltr">&lt;<a href=3D"mailto:[email protected]" targ=
et=3D"_blank">[email protected]</a>&gt;</span> wrote:<br><blockquote class=3D"gm=
ail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-le=
ft:1ex">Rather than having it execute javascript that=E2=80=99s locally mod=
ified, maybe we could have it just load some JSON?<br>
<br>
I know that the mirror can technically change anything, so this is not real=
ly a technical argument.<br>
<br>
I think it=E2=80=99s important to maintain a stance that it=E2=80=99s unacc=
eptable to change anything (other than this=E2=80=A6). Changing a bit of me=
ta data (a JSON file) seems less slippery slope than changing a bit of webs=
ite code.<br>
<span class=3D"HOEnZb"><font color=3D"#888888"><br>
<br>
Ask</font></span></blockquote></div><br></div>

--001a1135c59482cd6305619e8e0c--