sbassett added a comment.
In T292110#7574265 <https://phabricator.wikimedia.org/T292110#7574265>, @Michaelcochez wrote: > @sbassett Is that something which should be checked now, during the security readiness review, or only later upon deployment? > > I have added the TLS option to the implementation, but the fact that we still allow starting a http version remains flagged. I believe that in the context of a Wikimedia production service deploy, this rule would likely be a false positive result, but again, something to confirm with #SRE <https://phabricator.wikimedia.org/tag/sre/>. For a local dev environment, it also seems unnecessary. The only time it would be a true positive, in my opinion, would be if the service did not have any kind of reverse proxy for TLS termination, i.e. it was directly exposed to the internet. TASK DETAIL https://phabricator.wikimedia.org/T292110 EMAIL PREFERENCES https://phabricator.wikimedia.org/settings/panel/emailpreferences/ To: Reedy, sbassett Cc: Lucas_Werkmeister_WMDE, sbassett, Michaelcochez, Martaannaj, Lydia_Pintscher, Addshore, WMDE-leszek, karapayneWMDE, Aklapper, Invadibot, Devnull, maantietaja, Akuckartz, Jcross, Dsharpe, DannyS712, Nandana, Lahi, Gq86, GoranSMilovanovic, QZanden, LawExplorer, _jensen, rosalieper, Scott_WUaS, Wikidata-bugs, aude, Bawolff, Mbch331, Legoktm
_______________________________________________ Wikidata-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected]
