Re: ssl-pinning in libcurl

2013-07-25 Thread Nick Zitzmann
(please don't top-post) On Jul 24, 2013, at 11:20 PM, venkatesh perumalla wrote: > But the comments of the function "servercert", it looks like it handles the > "man in the middle attack". > Should we have to do anything extra for avoiding "man in the middle attack". The whole point of TLS/SS

Re: CURLOPT_READFUNCTION performance issue

2013-07-25 Thread Michael Dowling
Hi Daniel, Thanks again for the test script. I was able to reproduce the performance issue by simply pointing the test script you provided to a simple web server that runs on node.js (change the URL in the test script to "http://localhost:8124";). I created a gist that contains the source of the t

Re: patch - Initial set of files for Curl on VMS using GNV toolkit.

2013-07-25 Thread Yang Tse
On Mon, Jul 15, 2013, John E. Malmberg wrote: > [...] set off files for building Curl on OpenVMS using the GNV > (GNu on VMS) tool kit, and the port of Bash 4.2.45 for OpenVMS that will be > released shortly. Merged as commit e277e20a6d Thanks, -- -=[Yang]=-

whether curl solves "man in the middle attack"

2013-07-25 Thread venkatesh perumalla
Hi, Whether curl does the ssl-pinning which can avoid "man in the middle attack". Does it do the strict validation. As explained in below link. https://www.owasp.org/index.php/Pinning_Cheat_Sheet#OpenSSL Because below comments of the function "servercert", it looks like it handles the "man in th

Re: ssl-pinning in libcurl

2013-07-25 Thread venkatesh perumalla
But the comments of the function "servercert", it looks like it handles the "man in the middle attack". Should we have to do anything extra for avoiding "man in the middle attack". /* * Get the server cert, verify it and show it etc, only call failf() if the * 'strict' argument is TRUE as otherw