Hacker News Reader

Comment by angry_octet | Hacker News Reader

Tried to download Mozilla Thunderbird lately? Have any luck finding a SHA checksum for it? Its hidden at: http://download.cdn.mozilla.net/pub/mozilla.org/thunderbird/...

You can't get it over SSL. Not to worry, the binary will be signed by Mozilla right? Yeah, GPG only. Not x.509 signed.

But hey, the online install page supplies it over SSL right? Well, sometimes. But it turns out they don't enforce SSL use. Cue SSLstrip.

PS On MacOS X 10.9 Apple by default prevents running unsigned binaries. Not to worry, Mozilla tells you how to bypass the check, not even hinting it has a very valid purpose. https://support.mozilla.org/en-US/kb/firefox-cant-be-opened-...

View on HN

Uh, in case you didn't notice, those SHA checksums are also PGP signed.

I Googled Mozilla Thunderbird and the first hit was the download page, using HTTPS. You're right SSL isn't enforced, but that's a chicken and egg problem for Firefox downloads I guess, now that TLS 1.2 is enforced and the user may be stuck with a browser not supporting that.

In case you didn't read, yes I said they were GPG signed. But they don't make that info available (or linked) on the main download page, you have to google to find it.

SSL 3 is still fine for protecting integrity, just not confidentiality, so it is okay for downloads.

Found an SSL source: https://ftp.mozilla.org/pub/mozilla.org/thunderbird/releases...

https://gpg.mozilla.org/pks/lookup?search=releases%40mozilla...

Up until recently even OpenSSL's own download page was not HTTPS.

Just like Mozilla's page, that makes perfect sense as long as the authenticity can be verified via other means, such as PGP signatures.

What use is having HTTPS to protect the very thing that you need to implement it. It's a basic chicken and egg problem, replayed every time OpenSSL gets compromised, and successfully circumvented by securing it with something else.

Think about it: there's an SSL break and you need to update OpenSSL. What good does it do you to have it available over SSL?

Tell that to building haskell from source. It depends on itself.

I remember back in the day you used to be able to build gcc with various other compilers to bootstrap yourself. I think gcc now requires gcc features, so you're in the same boat.

But anyway, the comparison isn't very good because haskell/gcc don't develop sudden security vulnerabilities that instantly turn existing binaries unusable for getting new ones.

The first C++ compiler was written in C++:

http://www.stroustrup.com/bs_faq.html#bootstrapping

However, the first C compiler was not written in C, but in NB, an intermediate step from B to C:

http://stackoverflow.com/questions/18125490/how-was-the-firs...

Because not all vulnerabilities are the same, and not all are total compromises. For example, BEAST was temporarily worked around by switching to use a stream cipher (RC4) instead of a block cipher. Everyone scrambled to update their OpenSSL version, then switched back, or they switched to an AEAD mode TLS 1.2.

Not that people shouldn't be using GPG, but only using it means you only protect the paranoid.

Reply on news.ycombinator.com