-
Notifications
You must be signed in to change notification settings - Fork 27
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add option for http #13
Comments
give control to the users means let them do the "wrong" choice, too. |
It should not be implemented as an »option«, but rather as a fallback. The flow should be like this:
|
Another suggestion based on @jancborchardt:
|
As our opinions deviate and as I need far more space to explain my point of view, I published a blog post regarding this issue: https://blog.entwicklerbier.org/2014/05/securing-the-internet-of-things-how-about-securing-the-internet-first |
I agree with @stefan-niedermann’s suggestion. @maltefiala it’s very simple: Many people don’t have the means to add SSL to their ownCloud instance. For whatever reason. As long as they are informed that this is insecure, it should still work. Otherwise you’ll lock a large part of potential users out which have no means of changing the reason anyway. @maltefiala btw, since Aykit is based in Vienna, you might want to meet up with @Raydiation – he’s the developer of the News and Notes apps (and the Appframework) and based in Vienna as well! :) |
Connection without SSL will not be tolerated. |
@maltefiala Your stance about http/https is laudable, however there are cases where http makes sense (e.g., hosting owncloud on a home server that is accessible only over VPN, with the VPN server at the same machine listening to port 443 to avoid firewalls). |
@prasinos even there the HTTPS setup will work ;) |
@Raydiation True ;) But, it requires changing the config of the openvpn server to listen to some other port, and the config of the router to redirect 443 to the new port, etc. Not that difficult of course, but it's not that clean either. |
There is a wish for allowing http-Connections: owncloud/notes#45
I propose we implement an option to allow http. This option will be off by default. That is quite a reverse approach to other software and could be misleading. However, it represents aykit's support for more secure software far better.
This issue should be updated when an agreement has been found.
The text was updated successfully, but these errors were encountered: