From: Drak <drak@zikula•org>
To: Odinn Cyberguerrilla <odinn.cyberguerrilla@riseup•net>
Cc: Bitcoin Dev <bitcoin-development@lists•sourceforge.net>
Subject: Re: [Bitcoin-development] Dedicated server for bitcoin.org, your thoughts?
Date: Sun, 8 Dec 2013 10:00:35 +0000 [thread overview]
Message-ID: <CANAnSg1DiPLqAGW=2Q0zoLjupn8wvYuhhH8HgvBM0d=5uKJNXA@mail.gmail.com> (raw)
In-Reply-To: <1795f3067ba3fcdd0caf978cc59ff024.squirrel@fruiteater.riseup.net>
[-- Attachment #1: Type: text/plain, Size: 4489 bytes --]
There is really no excuse for not using an SSL certificate. Without one it
would be trivial for an attacker to change the contents of the page via
MITM.
Recent studies have shown MASSIVE abuse of the BGP routing protocol being
used to redirect websites through a third party.
This is not a theoretical attack, it's happening every single day on a
global scale and could be used to divert users to a rogue versions of
software.
It's just a matter of time... it will happen sooner or later given the
incentives it could bring...
Recent references:
http://www.theregister.co.uk/2013/11/22/net_traffic_redirection_attacks/
http://www.wired.com/threatlevel/2013/12/bgp-hijacking-belarus-iceland/
The only way to mitigate these MITMs is to use SSL.
Also it's about time we hosted the Bitcoin Qt software at Github. They have
a releases feature where you can upload a packaged release (see
https://github.com/blog/1547-release-your-software). There are also no
adverts (another privacy leak at the least) and many feel are more
trustworthy than Sourceforge: it also makes sense to have the downloads
where the source is developed.
Regards,
Drak
On 8 December 2013 03:38, Odinn Cyberguerrilla <
odinn.cyberguerrilla@riseup•net> wrote:
> Hello, re. the dedicated server for bitcoin.org idea, I have a few
> thoughts
>
> 1) I have commented in a blogpost of August 2013 at
> https://odinn.cyberguerrilla.org/ with some thoughts relative to possible
> issues with CA related to bitcoin.org - where I mentioned something
> relative to the DigiCert certificate,
> "DigiCert “may revoke a Certificate, without notice, for the reasons
> stated in the CPS, including if DigiCert reasonably believes that” (…)
> “Applicant is added to a government list of prohibited persons or entities
> or is operating from a prohibited destination under the laws of the United
> States” (…) “the Private Key associated with a Certificate was disclosed
> or Compromised”"
> In the same post I mentioned
> "Bitcoin.org has no certificate, no encryption — a situation which has its
> own obvious problems. Bitcoin.org currently sends users to download the
> bitcoin-qt client from sourceforge. Sourceforge is encrypted and has a
> certificate based on GeoTrust:
> https://www.geotrust.com/resources/repository/legal/"
>
> (Currently (Dec. 7, 2013) bitcoin.org shows as 'not verified' and 'not
> encrypted' examining it in a cursory fashion w/ Chrome)
>
> Not sure how this would work, but it would be nice to see the content at
> bitcoin.org encrypted, of course, but also further decentralized? how many
> mirrors are there of bitcoin.org - not sure, but a few things that come to
> mind when thinking of this are Tahoe-LAFS and also .bit stuff (namecoin).
> There are many ways to decentralize something but that is just something
> that comes to mind.
>
> This has been discussed at https://bitcointalk.org/index.php?topic=16312.0
> ('Is Bitcoin.org a weakness of bitcoin?) in the past and see also this
> https://bitcointalk.org/index.php?topic=119652.0 which discusses mirroring
> of certain content
>
> Some things to think about.
>
> > I would like to know what are your thoughts on moving bitcoin.org on a
> > dedicated server with a SSL certificate?
> >
> > I am considering the idea more seriously, but I'd like some feedback
> > before taking steps.
> >
> > Saïvann
> >
> >
> ------------------------------------------------------------------------------
> > Sponsored by Intel(R) XDK
> > Develop, test and display web and hybrid apps with a single code base.
> > Download it for free now!
> >
> http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk
> > _______________________________________________
> > Bitcoin-development mailing list
> > Bitcoin-development@lists•sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/bitcoin-development
> >
>
>
>
>
> ------------------------------------------------------------------------------
> Sponsored by Intel(R) XDK
> Develop, test and display web and hybrid apps with a single code base.
> Download it for free now!
>
> http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists•sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
[-- Attachment #2: Type: text/html, Size: 6648 bytes --]
next prev parent reply other threads:[~2013-12-08 10:01 UTC|newest]
Thread overview: 56+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-08 1:17 Saïvann Carignan
2013-12-08 3:38 ` Odinn Cyberguerrilla
2013-12-08 9:03 ` Saïvann Carignan
2013-12-08 12:37 ` Luke-Jr
2013-12-08 19:16 ` Drak
2013-12-08 19:25 ` Gregory Maxwell
2013-12-08 20:28 ` Mike Hearn
2013-12-08 20:40 ` Gregory Maxwell
2013-12-08 20:51 ` Drak
2013-12-08 21:01 ` Luke-Jr
2013-12-08 21:11 ` Drak
2013-12-08 23:51 ` theymos
2013-12-09 0:06 ` Taylor Gerring
2013-12-09 6:29 ` Jeremy Spilman
2013-12-09 10:54 ` Roy Badami
2013-12-10 9:18 ` Odinn Cyberguerrilla
2013-12-08 21:09 ` Gregory Maxwell
2013-12-08 21:16 ` Saïvann Carignan
2013-12-08 21:58 ` Roy Badami
2013-12-08 23:03 ` Mike Hearn
2013-12-09 5:32 ` Jeff Garzik
2013-12-08 22:44 ` Gavin Andresen
2013-12-08 23:48 ` Saïvann Carignan
2013-12-08 23:18 ` Luke-Jr
2013-12-08 23:29 ` Patrick
2013-12-08 21:46 ` Mark Friedenbach
2013-12-08 20:40 ` Drak
2013-12-08 20:50 ` Gregory Maxwell
2013-12-08 21:07 ` Drak
2013-12-08 21:14 ` Gregory Maxwell
2013-12-08 22:27 ` Robert McKay
2013-12-12 20:51 ` Adam Back
2013-12-31 13:39 ` Drak
2013-12-31 13:48 ` Gregory Maxwell
2013-12-31 13:59 ` Mike Hearn
2013-12-31 14:18 ` Gregory Maxwell
2013-12-31 14:23 ` Mike Hearn
2013-12-31 21:25 ` Jeremy Spilman
2013-12-31 21:33 ` Matt Corallo
2014-01-01 10:02 ` Jeremy Spilman
2014-01-01 11:37 ` Wladimir
2014-01-01 15:10 ` Mike Hearn
2014-01-01 22:15 ` Mike Hearn
2014-01-02 19:49 ` Jorge Timón
2013-12-31 14:05 ` Benjamin Cordes
2014-01-03 5:45 ` Troy Benjegerdes
2014-01-03 9:59 ` Drak
2014-01-03 11:22 ` Tier Nolan
2014-01-03 13:09 ` Adam Back
2014-01-03 17:38 ` Troy Benjegerdes
2014-01-03 18:21 ` Jorge Timón
2014-01-04 1:43 ` Troy Benjegerdes
2013-12-08 10:00 ` Drak [this message]
2013-12-08 12:39 ` Luke-Jr
2013-12-08 16:51 ` Gregory Maxwell
2013-12-08 16:08 ` Wladimir
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CANAnSg1DiPLqAGW=2Q0zoLjupn8wvYuhhH8HgvBM0d=5uKJNXA@mail.gmail.com' \
--to=drak@zikula$(echo .)org \
--cc=bitcoin-development@lists$(echo .)sourceforge.net \
--cc=odinn.cyberguerrilla@riseup$(echo .)net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox