Re: SSL certificate issues for git.gnus.org

[asjo@koldfront.dk (Adam Sjøgren)]

On Mon, 28 Feb 2011 13:33:44 -0600, Ted wrote:

> On Fri, 25 Feb 2011 23:59:43 +0100 asjo@koldfront.dk (Adam Sjøgren) wrote: 

AS> The only difference in security is whatever confirmation of identity the
AS> organisation signing the certificate performs, right?

> You're talking about abstract security, as a signing process.  I'm
> saying the *user* has to either import the self-signed certificate off
> the website and hope it's not compromised or he has to disable
> http.sslVerify.

No, I am talking about the difference between knowing that the traffic
isn't snoopable between client and server (more secure than plain text)
vs. that+someone having said "the server is who the server claims to
be" (arguably slightly-to-a-lot more secure, depending on who you trust).

I think it was a fundamental error to conflate those two things. But
hey, it made some people very, very rich - and we got Ubuntu.

> Furthermore, a self-signed certificate looks unprofessional.

"I wear my unprofessionalism as a badge of honor. Professionalism has no
  place in art"

> On Sat, 26 Feb 2011 08:51:30 +0100 Julien Danjou <julien@danjou.info> wrote: 

JD> I hate this certificate business which brings nothing if just money
JD> to bad companies.

> I respectfully disagree.  The current prices on the major sellers are
> certainly ridiculous but there are many reasonable and even free ones.

Alas, the ones that are free either aren't in the Major Browsers by
default, or they (arbitrarily) don't allow you to create certificates
for multiple domains (subjectAltNames).


  Best regards,

    Adam

-- 
 "But they are all following you!                             Adam Sjøgren
  No, they ain't, I'm just in front"                     asjo@koldfront.dk