http subversion URLs should be discontinued in favor of https URLs

[Igor Mozolevsky]

On 10 December 2017 at 19:47, Yuri <yuri at rawbw.com> wrote:

> On 12/10/17 11:36, Igor Mozolevsky wrote:
>
> If I give my bank card and PIN to someone who I don't trust, I can't
> complain that my bank doesn't take adequate precautions if that person
> drains my bank account! You choose to go down a route that **you** know is
> compromised!
>
>
> 1. The user has set up the subversion source trees based on the *current
> advice* here for anonymous checkout: https://wiki.freebsd.org/
> PortsSubversionPrimer
>
> > % svn co http://svn.freebsd.org/ports/head /usr/ports
>
> 2. The user heard that Tor improves his anonymity, and decided to use it.
>
> 3. The user updated the sources through Tor and got hacked.
>
> Where did this user go wrong, or where has he been irresponsible?
>
>
> The fact that this page https://wiki.freebsd.org/PortsSubversionPrimer still recommends http is appalling!
>
>
The freebsd wiki doesn't recommend Tor, does it?! If the user was so badly
educated about Tor, why is it FreeBSD's problem, honestly? What you're
saying is no different, than "Alice" doesn't want to download FreeBSD
herself, so she asks "Eve" to get her a CD with the source code.
Unbeknownst to Alice, Eve replaces a bunch of files on the CD and present
the CD to Alice as a bona fide copy. The problem in the chain is Eve (or
Tor, in your case) not where Eve got the CD from!

This discussion is turning circular and, quite frankly, ridiculous!

-- 
Igor M.