http subversion URLs should be discontinued in favor of https URLs

[John-Mark Gurney]

Igor Mozolevsky wrote this message on Wed, Dec 06, 2017 at 15:04 +0000:
> On 5 December 2017 at 23:18, RW via freebsd-security <
> freebsd-security at freebsd.org> wrote:
> 
> > On Tue, 5 Dec 2017 14:08:49 -0800
> > Gordon Tetlow wrote:
> >
> >
> > > Using this as a reason to not move to HTTPS is a fallacy. We should do
> > > everything we can to help our end-users get FreeBSD in the most secure
> > > way.
> >
> > I think it's more a question of whether all users should be forced onto
> > https even if it might prevent some users from getting security updates.
> 
> If updates are signed, then I don't see what can be gained by using
> relatively expensive HTTPS over HTTP.

The discussion has been for svn updates over http, not for freebsd-update
updates which are independantly signed and verified..  There is currently
no signatures provided via SVN to validate any source received via http.

-- 
  John-Mark Gurney				Voice: +1 415 225 5579

     "All that I will do, has been done, All that I have, has not."