Mailing-List: contact dev-help@chemistry.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@chemistry.apache.org
Received-SPF: pass (nike.apache.org: domain of peter.schmidt@alfresco.com
 designates 207.126.144.153 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <9FAC356C8627E0429B4A37F6E3D39B802F508E88@DEWDFEMB10B.global.corp.sap>
References: 
 <9FAC356C8627E0429B4A37F6E3D39B802F508E88@DEWDFEMB10B.global.corp.sap>
Date: Fri, 17 May 2013 14:42:55 +0100
Message-ID: 
 <CAFzZK1aNxyzEnmmUzeNpe5+DFy8EjG5RJgxEvHhKQAW1_hHvrw@mail.gmail.com>
Subject: Re: kCMISSessionAllowUntrustedSSLCertificate
From: Peter Schmidt <peter.schmidt@alfresco.com>
To: "Eberlein, Peter" <peter.eberlein@sap.com>,
 Mike Hatfield <mike.hatfield@alfresco.com>
Cc: Apache Chemistry <dev@chemistry.apache.org>,
	"objective-cmis@googlegroups.com" <objective-cmis@googlegroups.com>
Content-Type: multipart/alternative; boundary=001a11c2ca40014ef904dcea29eb

--001a11c2ca40014ef904dcea29eb
Content-Type: text/plain; charset=ISO-8859-1

Hi Peter
many thanks for your comments. As I am about to leave Alfresco in less than
a week I would like to pass this question on to Mike Hatfield (cc'd)

Kind regards
Peter


On 17 May 2013 13:54, Eberlein, Peter <peter.eberlein@sap.com> wrote:

>  Hi Peter,
>
>  I noticed the new session parameter,
> kCMISSessionAllowUntrustedSSLCertificate, that you introduced. If set,
> server certificate validation is skipped so SSL connections to untrusted
> servers can be established.
>
>  I don't think that we should have such a parameter. The world is already
> insecure enough without encouraging people to deactivate essential security
> settings. If there is a need to accept untrusted server certificates *
> temporarily*, like during development, than this can easily be done by
> providing a custom authentication provider. This was already possible
> before this change, without extending the standard implementation with
> insecure code. Or did I miss something? I would feel a lot better if this
> whole "feature" was removed again and whoever needs to do such messy things
> does them in own code in a custom authentication provider.
>
>  Or is it just me who is overly sensitive here? What does everyone else
> think?
>
>  Peter
>
>
>


-- 
Kind regards
Peter

-----------
*Peter Schmidt*
*Alfresco Software Ltd.*
*UK: 07748 185496*
*Int.: +44 7748 185496*
*Skype: pweschmidt*

--001a11c2ca40014ef904dcea29eb--