git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [RFC/PATCH] send-email: die if CA path doesn't exist

From
Jeff King <peff@peff.net>
Date
Nov 20, 2015, 11:18 UTC
Message-ID
<20151120111848.GC11198@sigill.intra.peff.net>
In-Reply-To
<27f354a4edb166e42006b0c1f778827a3dfd58ac.1447798206.git.john@keeping.me.uk>
On Tue, Nov 17, 2015 at 10:12:07PM +0000, John Keeping wrote:
> If the CA path isn't found it's most likely to indicate a
> misconfiguration, in which case accepting any certificate is unlikely to
> be the correct thing to do.
Yeah, this seems like a crazy default for security-sensitive code.

I suspect some people will see breakage from applying this (because their systems are broken and they did not know it), but that is a good thing.

For people who know their systems are broken and want to proceed anyway, what is the appropriate work-around? Obviously it involves disabling peer verification, but would we want to include instructions for doing so (either in the error message, or perhaps mentioning it in the commit message)?

-Peff
Previous: John KeepingNext: John Keeping
Message 2 of 11 in “send-email: die if CA path doesn't exist”
  1. send-email: die if CA path doesn't existJohn Keeping, Nov 17, 2015
  2. Jeff KingNov 20, 2015
  3. John KeepingNov 20, 2015
  4. Jeff KingNov 24, 2015
  5. John KeepingNov 24, 2015
  6. Jeff KingNov 24, 2015
  7. John KeepingNov 24, 2015
  8. send-email: die if CA path doesn't existJohn Keeping, Nov 24, 2015
  9. Jeff KingNov 24, 2015
  10. John KeepingNov 25, 2015
  11. Jeff KingNov 25, 2015

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.