Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Stricter HTTPS #267

Merged
merged 6 commits into from
Feb 3, 2020
Merged

Stricter HTTPS #267

merged 6 commits into from
Feb 3, 2020

Commits on Jan 28, 2020

  1. Simplify HTTPS by always trying SNI 

    Before this commit, we end up trying any failed connection twice, which takes twice as long.  Since most failures have nothing to do with SNI, this seems excessinve.
    @mavit
    mavit committed Jan 28, 2020
    Configuration menu
    Copy the full SHA
    851b90a View commit details
    Browse the repository at this point in the history

  2. Don't fall back to HTTP when fetching pluin repo over HTTPS fails 

    - Many repository hosts (such as SourceForge or GitHub) will redirect to HTTPS if you try HTTP, and this will only become more common over time.
- If the failure was nothing to do with HTTPS, we take twice as long with no benfit.
- Falling back to HTTP undermines the purpose of HTTPS.
    @mavit
    mavit committed Jan 28, 2020
    Configuration menu
    Copy the full SHA
    7b0ddbd View commit details
    Browse the repository at this point in the history

  3. Verify HTTPS connections 

    Setting VERIFY_NONE makes us vulnerable to man-in-the-middle attacks, and undermines the purpose of HTTPS.
    @mavit
    mavit committed Jan 28, 2020
    Configuration menu
    Copy the full SHA
    d73537a View commit details
    Browse the repository at this point in the history

  4. Optionally allow insecure HTTPS

    @mavit
    mavit committed Jan 28, 2020
    Configuration menu
    Copy the full SHA
    b787c60 View commit details
    Browse the repository at this point in the history

  5. Add changelog entry for optional stricter HTTPS.

    @mavit
    mavit committed Jan 28, 2020
    Configuration menu
    Copy the full SHA
    30cc870 View commit details
    Browse the repository at this point in the history

  6. EditorConfig for HTML files.

    @mavit
    mavit committed Jan 28, 2020
    Configuration menu
    Copy the full SHA
    455f7e9 View commit details
    Browse the repository at this point in the history