> > This may intersect badly with our current policy of not shipping any CAs in > > base. > > I objected to the conversion of http -> https in base when it started. I saw > no good reason for it, and for the very reason you site, https is totally > useless in base until you have installed CA's.
The inclusion of public CAs is a source of active debate by core@. In advance of a final decision on that subject, we want to get ahead of some of this discussion. The FreeBSD Project's place on the interwebs is secured via HTTPS (with limited exception). Referring to material hosted by the Project using HTTPS is sound best practice that help us collectively improve our security posture. The links where the scheme was changed from http to https are all in documentation or comments, and are NOT used at runtime by developers, operators, or any meaningful automation (i.e. this isn't something pkg(1) or fetch(1) uses). While this process of updating http links to https does cause a bit of necessary churn, updating http links in documentation and comments is a reasonable activity that help us keep the project current with modern standards. Maintenance activities that enhance our trust with the community is not glamorous and comes in the form of many similar incremental improvements. Like many things in technology, the definition of what's relevant, competitive, and modern changes over time (including hardware, protocols, performance primitives, developer productivity, and security best practices). Moving to HTTPS for non-runtime links is a sensible example of an incremental improvement that should not be considered avant-garde in this day and age. Regardless of the outcome of core@'s decision to include and maintain public CAs in base (or change a default in the installer to install a port), modernizing docs or other maintenance activities that improve our security posture is a +1 activity from core@'s perspective. -sc (on behalf of core@) -- Sean Chittenden
signature.asc
Description: PGP signature
