Re: Adding Passim as a Fedora 40 feature?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


On Mon, Aug 28, 2023 at 9:50 PM Simo Sorce <simo@xxxxxxxxxx> wrote:
> On Mon, 2023-08-28 at 15:14 -0500, Chris Adams wrote:
> > Once upon a time, Richard Hughes <hughsient@xxxxxxxxx> said:
> > > On Mon, 28 Aug 2023 at 16:27, Leon Fauster via devel
> > > <devel@xxxxxxxxxxxxxxxxxxxxxxx> wrote:
> > > > whats the benefit of this "self-signed TLS certificate" (as it does
> > > > not provide any "security")? Is this stub for something later ... ?
> > >
> > > It's a good question. It provides encryption (so client A can provide
> > > the file to client B without client C being aware what's being sent)
> >
> > Without identification though, it doesn't do that, because there's no
> > way for client B to know it is really talking to client A - it could be
> > talking to client C with a man-in-the-middle attack and a different
> > self-signed cert pretending to be client A.
> It helps dealing with passive attacks, but not with active attacks.
> It could be improved by using TOFU, so that the window of impersonation
> is small, but requires clients to cache an association and then has
> weird failure modes to be dealt with if one of the actors get re-imaged
> or changes the cert for any reason.
> Richard,
> given your files are all independently integrity checked, you should
> probably not use a TLS connection, because it will be flagged up pretty
> rapidly if it is using a self-singed cert anyway.
> This thing works only within the same LAN, therefore already "within" a
> firewall so it does not need to cross any boundary for which encryption
> matters enough.
> Finally if an enterprise says TLS is a must you could give an option to
> use TLS if said enterprise provides the certs (they will probably
> disable the service anyway otherwise).

What about integration with Let's Encypt as an option, the cert
registration/renewal process is then pretty automated.
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct:
List Guidelines:
List Archives:
Do not reply to spam, report it:

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Users]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]

  Powered by Linux