You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@netbeans.apache.org by Kenneth Jaeger <kj...@gmail.com> on 2018/09/25 16:55:22 UTC
SECURITY: plugins.netbeans.org domain not secure
The plugins.netbeans.org does not use https by default, nor does it allow
https. An error occurs if you try to change it to https.
The updates.netbeans.org site does allow the use of https, but does not
redirect to https if http is used.
Re: SECURITY: plugins.netbeans.org domain not secure
Posted by Peter Steele <st...@gmail.com>.
Kenneth
apache.netbeans.org supports https, so once everything redirects here we
should be good by default. There is a Jira to find a solution to the plugin
hosting question once we go fully move over but I think that's the still
TBD. Maybe find that Jira and add some comments to mention the new home for
plugins should be https compatible and people will take that in to
consideration
On Tue, 25 Sep 2018 18:47 Antonio, <an...@vieiro.net> wrote:
> Hi Kenneth,
>
> I fully agree with you. I'd add a JIRA so we can remember it, but I
> won't classify this as a security problem. For me security issues have
> special priority, I don't see that priority here.
>
> Kind regards,
> Antonio
>
> On 25/09/18 19:16, Kenneth Jaeger wrote:
> > I understand since there is no login information being sent to
> > plugins.netbeans.org, that security is less of a concern, but this is a
> > front facing website. It is not just used by the IDE. Browsers are
> going
> > to start yelling at us when we go to any http site (as I personally think
> > they should be). Call me paranoid, but I think the trend toward 100% of
> > web traffic being TLS encrypted is a good one. Also if
> plugins.netbeans.org
> > upgrades to HTTP2, it MUST be TLS then.
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
> For additional commands, e-mail: dev-help@netbeans.incubator.apache.org
>
> For further information about the NetBeans mailing lists, visit:
> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>
>
>
>
Re: SECURITY: plugins.netbeans.org domain not secure
Posted by Antonio <an...@vieiro.net>.
Hi Kenneth,
No need to apologize at all. On the contrary. I think it's very good
reporting things that we think are security concerns. Whether these are
really affecting users' security or not can be discussed later. The
important thing is to raise these quickly and clearly, as you've done.
So thank you for that.
Kind regards,
Antonio
On 25/09/18 22:28, Kenneth Jaeger wrote:
> Apologies for not classifying this correctly. Yes, this is not a security
> issue with NetBeans itself.
>
> On Tue, Sep 25, 2018 at 1:47 PM Antonio <an...@vieiro.net> wrote:
>
>> Hi Kenneth,
>>
>> I fully agree with you. I'd add a JIRA so we can remember it, but I
>> won't classify this as a security problem. For me security issues have
>> special priority, I don't see that priority here.
>>
>> Kind regards,
>> Antonio
>>
>> On 25/09/18 19:16, Kenneth Jaeger wrote:
>>> I understand since there is no login information being sent to
>>> plugins.netbeans.org, that security is less of a concern, but this is a
>>> front facing website. It is not just used by the IDE. Browsers are
>> going
>>> to start yelling at us when we go to any http site (as I personally think
>>> they should be). Call me paranoid, but I think the trend toward 100% of
>>> web traffic being TLS encrypted is a good one. Also if
>> plugins.netbeans.org
>>> upgrades to HTTP2, it MUST be TLS then.
>>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
>> For additional commands, e-mail: dev-help@netbeans.incubator.apache.org
>>
>> For further information about the NetBeans mailing lists, visit:
>> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>>
>>
>>
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
For additional commands, e-mail: dev-help@netbeans.incubator.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: SECURITY: plugins.netbeans.org domain not secure
Posted by Kenneth Jaeger <kj...@gmail.com>.
Apologies for not classifying this correctly. Yes, this is not a security
issue with NetBeans itself.
On Tue, Sep 25, 2018 at 1:47 PM Antonio <an...@vieiro.net> wrote:
> Hi Kenneth,
>
> I fully agree with you. I'd add a JIRA so we can remember it, but I
> won't classify this as a security problem. For me security issues have
> special priority, I don't see that priority here.
>
> Kind regards,
> Antonio
>
> On 25/09/18 19:16, Kenneth Jaeger wrote:
> > I understand since there is no login information being sent to
> > plugins.netbeans.org, that security is less of a concern, but this is a
> > front facing website. It is not just used by the IDE. Browsers are
> going
> > to start yelling at us when we go to any http site (as I personally think
> > they should be). Call me paranoid, but I think the trend toward 100% of
> > web traffic being TLS encrypted is a good one. Also if
> plugins.netbeans.org
> > upgrades to HTTP2, it MUST be TLS then.
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
> For additional commands, e-mail: dev-help@netbeans.incubator.apache.org
>
> For further information about the NetBeans mailing lists, visit:
> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>
>
>
>
Re: SECURITY: plugins.netbeans.org domain not secure
Posted by Antonio <an...@vieiro.net>.
Hi Kenneth,
I fully agree with you. I'd add a JIRA so we can remember it, but I
won't classify this as a security problem. For me security issues have
special priority, I don't see that priority here.
Kind regards,
Antonio
On 25/09/18 19:16, Kenneth Jaeger wrote:
> I understand since there is no login information being sent to
> plugins.netbeans.org, that security is less of a concern, but this is a
> front facing website. It is not just used by the IDE. Browsers are going
> to start yelling at us when we go to any http site (as I personally think
> they should be). Call me paranoid, but I think the trend toward 100% of
> web traffic being TLS encrypted is a good one. Also if plugins.netbeans.org
> upgrades to HTTP2, it MUST be TLS then.
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
For additional commands, e-mail: dev-help@netbeans.incubator.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: SECURITY: plugins.netbeans.org domain not secure
Posted by Kenneth Jaeger <kj...@gmail.com>.
I understand since there is no login information being sent to
plugins.netbeans.org, that security is less of a concern, but this is a
front facing website. It is not just used by the IDE. Browsers are going
to start yelling at us when we go to any http site (as I personally think
they should be). Call me paranoid, but I think the trend toward 100% of
web traffic being TLS encrypted is a good one. Also if plugins.netbeans.org
upgrades to HTTP2, it MUST be TLS then.
On Tue, Sep 25, 2018 at 1:04 PM Antonio <an...@vieiro.net> wrote:
> Hi Kenneth,
>
> I don't think there's any security related problem here. The Apache
> Mirror System, for instance, uses "http" frequently. IMHO there's no
> need to encrypt files that are publicly available for everyone to see.
>
> Security is on the IDE side: verifying that the downloaded file has not
> been modified while on transit, either by using a PGP signature or other
> digesting techniques, as the ASF guidelines mandate.
>
> Cheers,
> Antonio
>
> El 25/09/2018 a las 18:55, Kenneth Jaeger escribió:
> > The plugins.netbeans.org does not use https by default, nor does it
> allow
> > https. An error occurs if you try to change it to https.
> >
> > The updates.netbeans.org site does allow the use of https, but does not
> > redirect to https if http is used.
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
> For additional commands, e-mail: dev-help@netbeans.incubator.apache.org
>
> For further information about the NetBeans mailing lists, visit:
> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>
>
>
>
Re: SECURITY: plugins.netbeans.org domain not secure
Posted by Antonio <an...@vieiro.net>.
On 26/09/18 06:17, Tim Boudreau wrote:
> The plugins site could sign modules, but since it aggregates modules from
> elsewhere, that wouldn't mean much. And if the signature is not tied to the
> download host, all it means is "someone signed it" - a proxy that injects
> code and signs the result would be trivial. If it were tied to the download
> host, module aggregators would be impossible.
>
Plugins could be digitally signed with PGP keys (ASF digital
certificates, anyone?). That would allow us to verify _the content_.
That's key in this, IMHO. Signature is not then tied to the download
host, but to the ASF itself (or to one of the ASF committers through
their PGP key).
> HTTPS is not just for protecting sensitive information. It is also for
> verifying that you're talking to the server you think you are. There is no
We can verify we're talking with a proper ASF mirror, but does says
nothing regarding security. The ASF mirror could have been hacked, for
instance (Gentoo mirrors were hacked in June 2018 [1]). I still believe
security is about the content, not about the transport.
> excuse in today's world for not using HTTPS for everything.
Agreed. HTTPS for everything. But also digital signatures for plugins.
Cheers,
Antonio
[1]
https://www.theinquirer.net/inquirer/news/3035066/gentoo-github-mirror-hacked
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
For additional commands, e-mail: dev-help@netbeans.incubator.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: SECURITY: plugins.netbeans.org domain not secure
Posted by Tim Boudreau <ni...@gmail.com>.
On Tue, Sep 25, 2018 at 1:04 PM Antonio <an...@vieiro.net> wrote:
> Hi Kenneth,
>
> I don't think there's any security related problem here. The Apache
> Mirror System, for instance, uses "http" frequently. IMHO there's no
> need to encrypt files that are publicly available for everyone to see.
Nonsense. There is nothing stopping a man in the middle attack from causing
you to download malicious bits masquerading as a module or injected into a
legitimate one.
The plugins site could sign modules, but since it aggregates modules from
elsewhere, that wouldn't mean much. And if the signature is not tied to the
download host, all it means is "someone signed it" - a proxy that injects
code and signs the result would be trivial. If it were tied to the download
host, module aggregators would be impossible.
HTTPS is not just for protecting sensitive information. It is also for
verifying that you're talking to the server you think you are. There is no
excuse in today's world for not using HTTPS for everything.
And before someone says "but you can have the SHA-1 hash as a separate
download, as a lot of sites offer, that is not a security measure, just a
way of checking if your download is corrupted - if you can fake the bits
you can fake the hash.
Either trust is end to end, or you don't have any.
-Tim
>
> Security is on the IDE side: verifying that the downloaded file has not
> been modified while on transit, either by using a PGP signature or other
> digesting techniques, as the ASF guidelines mandate.
>
> Cheers,
> Antonio
>
> El 25/09/2018 a las 18:55, Kenneth Jaeger escribió:
> > The plugins.netbeans.org does not use https by default, nor does it
> allow
> > https. An error occurs if you try to change it to https.
> >
> > The updates.netbeans.org site does allow the use of https, but does not
> > redirect to https if http is used.
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
> For additional commands, e-mail: dev-help@netbeans.incubator.apache.org
>
> For further information about the NetBeans mailing lists, visit:
> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>
>
>
> --
http://timboudreau.com
Re: SECURITY: plugins.netbeans.org domain not secure
Posted by Antonio <an...@vieiro.net>.
Hi Kenneth,
I don't think there's any security related problem here. The Apache
Mirror System, for instance, uses "http" frequently. IMHO there's no
need to encrypt files that are publicly available for everyone to see.
Security is on the IDE side: verifying that the downloaded file has not
been modified while on transit, either by using a PGP signature or other
digesting techniques, as the ASF guidelines mandate.
Cheers,
Antonio
El 25/09/2018 a las 18:55, Kenneth Jaeger escribió:
> The plugins.netbeans.org does not use https by default, nor does it allow
> https. An error occurs if you try to change it to https.
>
> The updates.netbeans.org site does allow the use of https, but does not
> redirect to https if http is used.
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
For additional commands, e-mail: dev-help@netbeans.incubator.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists