Re: [PATCH] wget: don't silently ignore certificate validation

2018-05-28 Thread Denys Vlasenko
On Sun, May 27, 2018 at 8:19 PM, Ralf Friedl wrote: > Denys Vlasenko wrote: >> >> wget should work for common use cases. >> Such as downloading sources of kernels, gcc and such. >> From build scripts, not only by hand. >> Without having to modify said scripts. >> Your patch breaks that. >> NAK. >

Re: [PATCH] wget: don't silently ignore certificate validation

2018-05-28 Thread Denys Vlasenko
On Sun, May 27, 2018 at 8:55 PM, Michael Conrad wrote: > The story just broke earlier this year how a casino hotel "smart > thermometer" in the fish tank was used as a backdoor to attack the rest of > their network. > > If a smart device running busybox is programmed to automatically check for > f

Re: [PATCH] wget: don't silently ignore certificate validation

2018-05-28 Thread Denys Vlasenko
On Sun, May 27, 2018 at 2:21 AM, Kang-Che Sung wrote: > On Sun, May 27, 2018 at 1:34 AM, Denys Vlasenko > wrote: >> wget should work for common use cases. >> Such as downloading sources of kernels, gcc and such. >> From build scripts, not only by hand. >> Without having to modify said scripts. >>

Re: [PATCH] wget: print warning when internal TLS is used

2018-05-28 Thread Denys Vlasenko
Applied with some edits, thanks! On Mon, May 28, 2018 at 12:33 AM, Jakub Jirutka wrote: > Internal TLS code (FEATURE_WGET_HTTPS) does not implement verification > of the server's certificate. It is documented in the code, but not > even mentioned in the --help message, so users typically don't k