Mailing-List: contact dev-help@flex.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@flex.apache.org
Received-SPF: error (athena.apache.org: local policy)
MIME-Version: 1.0
In-Reply-To: 
 <CACK5iZeSdASLiF0C28EhbmY1HjujSmnapqWy_1ASHehKM52hMw@mail.gmail.com>
References: 
 <CAJs+wW1dfM3cw2HeKkCCY-T_9V1SDUbWfJR3G5UfstkY5fukJA@mail.gmail.com>
	<D0F77936.25576%aharui@adobe.com>
	<54D23B00.20300@extravision.com>
	<CALorpXcWZiDcwvbmMmTiFTp35hLqjkZOMMHuD8kF9vrqcbRi9A@mail.gmail.com>
	<54D2434A.2070103@gmail.com>
	<D0F783B8.25597%aharui@adobe.com>
	<CACK5iZcJnv=CQvbpQfQdjrhKPoeMBb3nSJh2+kMgO=H3gNO46g@mail.gmail.com>
	<CCDE5E1A3636E94DAFC84D259AC75FA421A7D7A7@MCUSQUANXM01V.mcdsus.mcds.usmc.mil>
	<D0F8DEC5.25725%aharui@adobe.com>
	<54D4853C.9080407@extravision.com>
	<D0FA1ED2.258C8%aharui@adobe.com>
	<CACK5iZeSdASLiF0C28EhbmY1HjujSmnapqWy_1ASHehKM52hMw@mail.gmail.com>
Date: Fri, 6 Feb 2015 17:56:33 -0500
Message-ID: 
 <CALorpXey-dctvRC2QQn3JiH1OM6sayZiiqKA9NAhYk5ky7eVBg@mail.gmail.com>
Subject: Re: [Installer - FLEX-34251] Is SSK needed for load installer config?
From: Nicholas Kwiatkowski <nicholas@spoon.as>
To: dev@flex.apache.org
Content-Type: multipart/alternative; boundary=001a113d65d204ad94050e7355e6

--001a113d65d204ad94050e7355e6
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Ok.  Digging into this a bit more, the only time we will ever use HTTPS is
during the Installer Config download and the MD5s.

No reason why we need to be tunneling the Installer Config through HTTPS.
All it contains is localization strings for the current version.  MD5 paths
(and all paths, really) are stored on the Apache DIST server, and is pulled
down via HTTP.

MD5s are actually pulled down using HTTPS, again at the Apache DIST
server.  This is valuable to protect via HTTPS.

None of the Apache mirrors are serving files via HTTPS (if they are, they
aren't telling Apache about it -- or Apache isn't cataloging it).

Since nothing larger than 4k is being transferred over https, we don't have
to worry about using a raw https session that screws with TCP Window sizes
(essentially, if you try to create TCP packets too large in one shot, you
will get fragments, which causes major overhead and can cause the
download/upload speed to decrease by 60%).  The proxy thing would still
need to be addressed -- but those are becoming more and more rare.  No idea
how many people still use a proxy server, but they would be affected by
this unless we offer a configuration option for it.

On a side note -- if we are really worried about Man-In-The-Middle attacks,
the two things we should be protecting are the initial configuration
download (http://flex.apache.org/installer/sdk-installer-config-4.0.xml)
and the MD5s.  Everything else is checked via checksums, so we are safe
there.  We currently don't pull the sdk-installer-config-4.0.xml file off
HTTPS, and maybe we should.  I'd vote for dropping
/dist/flex/4.14.0/binaries/apache-flex-sdk-installer-config.xml from being
pulled over https.

I have some time to implement the as3httpdlib this weekend if that is the
direction we want to go.

-Nick

On Fri, Feb 6, 2015 at 11:16 AM, OmPrakash Muppirala <bigosmallm@gmail.com>
wrote:

> On Feb 6, 2015 7:37 AM, "Alex Harui" <aharui@adobe.com> wrote:
> >
> >
> >
> > On 2/6/15, 1:11 AM, "Tom Chiverton" <tc@extravision.com> wrote:
> >
> > >On 05/02/15 16:56, Alex Harui wrote:
> > >> What do others think?  IMO, for 3.2 we should just do the swap of an
> AS3
> > >> native HTTP implementation and not switch our urls to HTTP or add so=
me
> > >> checkbox.  Then we can get better data on how many problems that
> change
> > >> solved or if it introduces new issues.  Not that I=E2=80=99m volunte=
ering to
> do
> > >> that work.
> > >I vote for doing this. As you say, there's a chance everything will Ju=
st
> > >Work with it.
> >
> > Well, Nick is saying there will be other issues.  Om, have you run into
> > the issues Nick brings up?
> >
>
> No, I have not.  But I've never had to deal with large downloads using th=
is
> library.  In any case, I still think we should give it a try.
>
> Thanks,
> Om
>
> > -Alex
> >
>

--001a113d65d204ad94050e7355e6--