From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1PwyJR-0005YI-D1 for garchives@archives.gentoo.org; Tue, 08 Mar 2011 14:55:01 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 1A5C71C01A; Tue, 8 Mar 2011 14:54:53 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) by pigeon.gentoo.org (Postfix) with ESMTP id D570B1C031 for ; Tue, 8 Mar 2011 14:54:00 +0000 (UTC) Received: from pomiocik.lan (77-254-77-36.adsl.inetia.pl [77.254.77.36]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: mgorny) by smtp.gentoo.org (Postfix) with ESMTPSA id 41E151B411F; Tue, 8 Mar 2011 14:53:59 +0000 (UTC) Date: Tue, 8 Mar 2011 15:53:01 +0100 From: =?UTF-8?B?TWljaGHFgiBHw7Nybnk=?= To: gentoo-dev@lists.gentoo.org Cc: awaria@chopin.edu.pl Subject: Re: [gentoo-dev] Bugzilla 4 migration Message-ID: <20110308155301.6af83f28@pomiocik.lan> In-Reply-To: References: <4D7410E3.3070708@gentoo.org> <20110307101214.37beac3a@pomiocik.lan> <20110307144819.GA28374@kaini.schwarzvogel.de> <20110307204708.5da83080@pomiocik.lan> <1299528385.26337.22.camel@TesterTop4> <20110308152635.3f357d66@pomiocik.lan> Organization: Gentoo X-Mailer: Claws Mail 3.7.8 (GTK+ 2.24.1; x86_64-pc-linux-gnu) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org Mime-Version: 1.0 Content-Type: multipart/signed; micalg=PGP-SHA1; boundary="Sig_/TCxwU_6GkO2Wk+tnR6ZgMRN"; protocol="application/pgp-signature" X-Archives-Salt: X-Archives-Hash: efac902d54b5098b4e068967b6ef76cd --Sig_/TCxwU_6GkO2Wk+tnR6ZgMRN Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, 08 Mar 2011 16:41:08 +0200 Antoni Grzyma=C5=82a wrote: > On Tue, 8 Mar 2011 15:26:34 +0100, Micha=C3=85=E2=80=9A G=C3=83=C2=B3rny= wrote: > > On Mon, 07 Mar 2011 15:06:25 -0500 > > Olivier Cr=C3=AAte wrote: > > > >> On Mon, 2011-03-07 at 20:47 +0100, Micha=C5=82 G=C3=B3rny wrote: > >> > Why does everyone assume it needs to be enforced? If user is > >> > interested in protecting his/her data, he/she can simply use > >> > https://. If he/she is not, there is no real reason to enforce > >> > slower (and not always supported) SSL. > >> > >> Maybe it's not to protect the user, but to protect the Gentoo > >> infrastructure.. And really, SSL has been supported by every > >> browser for the last 15 years. And it is not in any way slow or > >> slower than non-SSL. > > > > If you really think you need to force all users to use SSL, thus > > assuming they're unable to make their own decisions, why don't you > > restrict bugzie access completely? >=20 > You don't seem to (or pretend not to) understand that using SSL=20 > protects not *the user* (in which case, yes, a user is free to leave > the door to *his own* house wide open), but the Gentoo infrastructure > that is far from his own and that all of us are using. Please explain to me how not using SSL for a particular bugzie user is going to hurt Gentoo infra. Even if we're talking about a dev, and we're really assuming a dev is completely unaware of security issues he/she's dealing with, I'd say power outage could cause more damage. > Besides, complaining about SSL being slow is absurd considering how > mildly interactive and how low-traffic a typical bugzilla session is. > You could do just fine over a 9600 bps modem. It is more absurd to waste 5 minutes trying to establish login session due to packet loss. --=20 Best regards, Micha=C5=82 G=C3=B3rny --Sig_/TCxwU_6GkO2Wk+tnR6ZgMRN Content-Type: application/pgp-signature; name=signature.asc Content-Disposition: attachment; filename=signature.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (GNU/Linux) iEYEARECAAYFAk12QtUACgkQnGSe5QXeB7trcgCfY72uplqCa68fXJgDsUhBMOmp VYEAn3C2vWu9KumFzr43X1vSWEP/JszY =85NN -----END PGP SIGNATURE----- --Sig_/TCxwU_6GkO2Wk+tnR6ZgMRN--