I don't disagree with that assertion at all, however, i'm curious to know what percentage of people actually run a checksum after they've downloaded an ISO or package. At any rate, the let's encrypt SSL certs are a nice feature to have it would be great to use them on the mirrors. Sent from my iPad > On Jan 17, 2017, at 7:40 PM, Levi Pihema-Lindsay <levi at 2prointl.co> wrote: > > Actually, > > If a master mirror gets hacked, and an ISO replaced, the modified copy will be rsync'd to the mirrors. So, it's still in people's best interests to (even if downloading over SSL) checksum the ISO > > -L > >> On 18/01/2017, at 2:38 PM, Ryan Nix <ryan.nix at gmail.com> wrote: >> >> The performance hit is negligible, especially for someone like Northwestern that is part of Internet2. We also have a SSD drive pushing the bits on the mirror. Personally, there is no reason not to use SSL wherever possible, especially with Let’s Encrypt being free and automated. There is a reason Google gives preferential rankings to sites that use SSL. Yes, there are checksums on the CentOS ISOs and packages, but how many people actually do that after a download? Using SSL reduces the need to checksums. >> >>> On Jan 17, 2017, at 7:52 AM, cdnops at as250.net wrote: >>> >>> Dear Ryan, >>> >>> I am curious... >>> >>> which advantages did you intend to get out of the redirect? >>> >>> imho doesn't offer any increase in security at all: >>> >>> 1) The packages are signed, so their integrity is protected. >>> >>> 2) Confidentiality of the request is already broken before the redirect. >>> >>> 3) MITM/Downgrade can already happen there. >>> >>> So unless HTTPS becomes standard delivery method or HSTS is honored, >>> this is a moot exercise anyway that just leads to lower performance. >>> >>> If HTTPS becomes the standard delivery method, against which CA base >>> will certificates be checked? Having signed packages already solves this >>> problem nicely and at the most convenient layer. >>> >>> Please don't get me wrong... generally I think enabling TLS is a >>> great idea, but in this case I'm doubtful of the benefit. >>> >>> Kind regards >>> AS250.net >>> CDN OPS >>> _______________________________________________ >>> CentOS-mirror mailing list >>> CentOS-mirror at centos.org >>> https://lists.centos.org/mailman/listinfo/centos-mirror >> >> _______________________________________________ >> CentOS-mirror mailing list >> CentOS-mirror at centos.org >> https://lists.centos.org/mailman/listinfo/centos-mirror > > _______________________________________________ > CentOS-mirror mailing list > CentOS-mirror at centos.org > https://lists.centos.org/mailman/listinfo/centos-mirror