Profanity: Site SSL Issue

[Atavic]

I browse to https://www.profanity.im and I get This Connection is Untrusted as browser warning.

By looking at Certificate Status I get Common Name (CA): *.123-secure.com

SSL Server Test by Qualys gives: Certificate name mismatch

Maybe there's a problem with Shared SSL?

[jubalh]

@boothj5 this is for you :-)

[Atavic]

http://www.profanity.im/ works, but it doesn't over https

[jubalh]

Yes we got that ;)
But @boothj5 is the only one with access to it.

[Atavic]

As long as the site is reachable, it's good for me.

[jubalh]

Actually https still doesn't work :(

[kawaii]

If this is simply a case of the website needing someone with time and server space then I'm happy to volunteer myself to help out with maintaining that and dealing with the TLS issue.

[jubalh]

Basically it's just that.
However I thought GitHub Pages might be working for us too. And profanity.im could forward there. Waiting for @boothj5 s decision :-)

[jubalh]

We have https://profanity-im.github.io/ now.

[lol768]

why don't you use the custom domain with github pages? currently profanity.im is still linked everywhere and it's not secure because its TLS is misconfigured.

[mdosch]

They want to configure a forward but boothj5 was too busy to set it up so far and jubalh has no access to this domain.
BTW, how can a website where you only read as there is no possibility to login or submit personal data be considered 'insecure'?

[lol768]

They want to configure a forward but boothj5 was too busy to set it up so far and jubalh has no access to this domain.

Fair enough - fingers crossed it happens soon.

BTW, how can a website where you only read as there is no possibility to login or submit personal data be considered 'insecure'?

I'm glad you asked - firstly, I want to point out that you've implicitly focussed on confidentiality and neglected the consider the other two-thirds of the CIA triad. These are integrity and availability respectively.

So, is it dangerous to serve a static website in plaintext which provides download links to source code that a user will fetch, compile and run (probably as root to install the binaries to /usr/bin)? Yes, it's absolutely dangerous because there is no integrity guarantee whatsoever. All it takes is an active MitM (or a man-on-the-side) to rewrite your plaintext HTTP response to point the download links at a piece of malware and your user is completely fucked. Such an attacker could just as easily inject an exploit for a browser zero day, or if they were less malicious, inject their own ads alongside your content to profit.

This isn't some impractical theoretical attack. Read up on FoxAcid if you want proof it works. This is one of the many reasons that every site should be being served securely, but it's even more important for software distribution sites.