g the door’s key under the carpet right in front
of the door.
Allowing to bypass/ignore certificate verification is ok-ish in some
situations, but only when the user do it consciously, using explicit
option such as --no-check-certificate, not silently as the default
option.
Jakub
On 2018-05-25
//config: If you still think this is unacceptable, send patches.
That’s exactly what I did.
http://lists.busybox.net/pipermail/busybox/2018-May/086444.html
Jakub
On 2018-05-26 17:54, Denys Vlasenko wrote:
On Sat, May 26, 2018 at 5:39 PM, wrote:
That's a crime against sec
Internal TLS code (FEATURE_WGET_HTTPS) does not implement validation
of the server's certificate. It is documented in the code, but not
even mentioned in the --help message, so users typically don't know
about this behaviour. That's a crime against security!
This patch changes this behaviour for
Internal TLS code (FEATURE_WGET_HTTPS) does not implement verification
of the server's certificate. It is documented in the code, but not
even mentioned in the --help message, so users typically don't know
about this behaviour. That's a crime against security!
This patch adds a warning message;
1 14:48:42--
> https://raw.githubusercontent.com/mirror/busybox/master/INSTALL
> <https://raw.githubusercontent.com/mirror/busybox/master/INSTALL>Connecting
> to proxy_ip:8080... connected.Proxy request sent, awaiting response... 200
&g
th 124: HTTP:
CONNECT raw.githubusercontent.com:443
<http://raw.githubusercontent.com:443> HTTP/1.1*
which seems to be a correct approach, since I'm using http proxy.
Best regards,
Jakub Ledwon
pon., 21 sty 2019 o 16:47 Denys Vlasenko
napisał(a):
> On Mon, Jan 21, 2019 at 2:53 PM
