As a user I would want to be able to override this, does this patch make this impossible?<br><br>Sent from my mobile. Please forgive shortness, typos and weird autocorrects.<div class="quote" style="line-height: 1.5"><br><br>-------- Original Message --------<br>Subject: Re: [sword-devel] SWORD 1.8.0RC3<br>From: Jaak Ristioja <jaak@ristioja.ee><br>To: sword-devel@crosswire.org<br>CC: <br><br><br type="attribution"><blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Sure! Verifying TLS certificates is explicitly disabled the file<br><br> src/mgr/curlhttpt.cpp<br><br>by the lines:<br><br> /* Disable checking host certificate */<br> curl_easy_setopt(session, CURLOPT_SSL_VERIFYPEER, false);<br><br>I've attached a patch for Sword SVN trunk which removed these lines. For<br>the Sword++ commit, see<br>https://github.com/swordxx/swordxx/commit/49de93ca35f61601376fab0ac8689f48a76dd4d6<br><br>J<br><br><br>On 26.06.2017 04:10, Greg Hellings wrote:<br>> Jaak,<br>> <br>> Can you provide a version of that patch for 1.7 (and 1.8, if there is a<br>> difference)? Or point me to where it lives? I will definitely wrap that<br>> into the packaging for Fedora and SuSE as it is absolutely inappropriate<br>> to have SSL checking skipped at the library level without it being a<br>> very explicit step for users.<br>> <br>> If Troy won't fix this glaring security hole, it can at least be fixed<br>> by the packagers. I would encourage any Debian and/or Ubuntu users to<br>> file bugs against Sword packaging in their environments (if their<br>> maintainer isn't here) and the same for any other distribution users.<br>> <br>> --Greg<br>> <br>> On Sun, Jun 25, 2017 at 6:56 PM, Jaak Ristioja <jaak@ristioja.ee<br>> <mailto:jaak@ristioja.ee>> wrote:<br>> <br>> Regarding TLS, I think the choice of whether to trust a self-signed<br>> certificate should explicitly be left to the user at run-time (e.g like<br>> browsers do), rather than blindly accepting any (even expired?)<br>> certificates.<br>> <br>> Regarding the other fix, frontends can (and already do) handle threading<br>> by themselves, but afaik even for a single-threaded process the<br>> callbacks accepted by Sword have no direct means to terminate the<br>> installation process (e.g. by return value, or via a another callback<br>> provided to the callback). So it seems that you're either saying that<br>> <br>> 1) Sword users have no means to terminate potentially long-running<br>> processes (and there's no plan to add such means), or<br>> 2) RemoteTransport::terminate() should never be called separately, but<br>> exclusively only from inside callbacks invoked by Sword.<br>> <br>> In the latter case, this should be made clear in the documentation.<br>> <br>> Blessings,<br>> J<br>> <br>> On 25.06.2017 21 <tel:25.06.2017%2021>:53, Troy A. Griffitts wrote:<br>> > We have included some of your patches in the past (thank you<br>> again), but<br>> > not these. The first is intentional. We want to work with self signed<br>> > certs if necessary. Non of our content is private, only the fact<br>> that a<br>> > user might access our server and for this, we ask all our frontends to<br>> > warn against this for persecuted countries. The second goes<br>> against our<br>> > policy in the library that all threading should be handled by the<br>> > client, not the library. The client should instantiate an<br>> InstallMgr in<br>> > its own thread and register threads are callbacks, if they wish to<br>> > install in the background. If we start trying to handle threading<br>> in the<br>> > library itself, it is a huge switch from current policy and depends on<br>> > support for threading in all our compilers. Easy enough to just<br>> > instantiate separate SWMgr instances per thread. But thank you for<br>> offering.<br>> > Troy<br>> ><br>> > On June 25, 2017 8:33:53 PM GMT+02:00, Jaak Ristioja<br>> <jaak@ristioja.ee <mailto:jaak@ristioja.ee>><br>> > wrote:<br>> ><br>> > Hi Troy!<br>> ><br>> > It seems that no fixes from Sword++ were considered for<br>> inclusion in SVN<br>> > trunk, not even the two I explicitly proposed on this list in<br>> response<br>> > to the RC2 announcement: one fixing hangs in front ends and<br>> the other<br>> > fixing a pure security negligence which rendered SSL/TLS<br>> susceptible to<br>> > MitM attacks.<br>> ><br>> > ?!?!<br>> ><br>> > J<br>> ><br>> > On 25.06.2017 18 <tel:25.06.2017%2018>:51, Troy A. Griffitts<br>> wrote:<br>> ><br>> > Again, thank you to all the testers and reporters of problems<br>> > for the<br>> > previous RC and those who contributed fixes. Hopefully, this<br>> > will stand<br>> > any scrutiny and become 1.8.0. Please let me know if you have<br>> > any feedback.<br>> ><br>> > <br>> http://crosswire.org/sword/alpha/alpha/sword-1.7.903.tar.gz<br>> <http://crosswire.org/sword/alpha/alpha/sword-1.7.903.tar.gz><br>> ><br>> ><br>> > Included since last RC:<br>> ><br>> > <br>> ------------------------------------------------------------------------<br>> ><br>> > r3482 | scribe | 2017-06-25 07:36:23 -0700 (Sun, 25 Jun 2017) |<br>> > 2 lines<br>> ><br>> > Reworked strongs and lemma filters to better support any combo<br>> > of toggle<br>> > Added osisxhtml lemma type= support for other than Greek, Hebrew<br>> > strongs<br>> > <br>> ------------------------------------------------------------------------<br>> ><br>> > r3481 | scribe | 2017-06-25 04:45:04 -0700 (Sun, 25 Jun 2017) |<br>> > 3 lines<br>> ><br>> > moved examples/simple.cpp to examples/tasks/simpleverselookup.cpp<br>> ><br>> > also updated CMakeList.txt to build new examples<br>> > <br>> ------------------------------------------------------------------------<br>> ><br>> > r3480 | scribe | 2017-06-25 04:44:29 -0700 (Sun, 25 Jun 2017) |<br>> > 1 line<br>> ><br>> > added listbiblebooknames example<br>> > <br>> ------------------------------------------------------------------------<br>> ><br>> > r3479 | scribe | 2017-06-25 04:44:01 -0700 (Sun, 25 Jun 2017) |<br>> > 1 line<br>> ><br>> > added flatapi installmgr example<br>> > <br>> ------------------------------------------------------------------------<br>> ><br>> > r3478 | refdoc | 2017-06-10 15:28:11 -0700 (Sat, 10 Jun 2017) |<br>> > 2 lines<br>> ><br>> > added Belarussian locale file<br>> ><br>> > <br>> ------------------------------------------------------------------------<br>> ><br>> > r3477 | domcox | 2017-06-04 11:18:34 -0700 (Sun, 04 Jun 2017) |<br>> > 1 line<br>> ><br>> > French translation update (Contrib. from Cyrille)<br>> > <br>> ------------------------------------------------------------------------<br>> ><br>> ><br>> ><br>> > <br>> ------------------------------------------------------------------------<br>> ><br>> > sword-devel mailing list: sword-devel@crosswire.org <mailto:sword-devel@crosswire.org><br>> > http://www.crosswire.org/mailman/listinfo/sword-devel<br>> <http://www.crosswire.org/mailman/listinfo/sword-devel><br>> > Instructions to unsubscribe/change your settings at above page<br>> ><br>> ><br>> ><br>> > <br>> ------------------------------------------------------------------------<br>> ><br>> > sword-devel mailing list: sword-devel@crosswire.org <mailto:sword-devel@crosswire.org><br>> > http://www.crosswire.org/mailman/listinfo/sword-devel<br>> <http://www.crosswire.org/mailman/listinfo/sword-devel><br>> > Instructions to unsubscribe/change your settings at above page<br>> ><br>> ><br>> > --<br>> > Sent from my Android device with K-9 Mail. Please excuse my brevity.<br>> ><br>> ><br>> > _______________________________________________<br>> > sword-devel mailing list: sword-devel@crosswire.org <mailto:sword-devel@crosswire.org><br>> > http://www.crosswire.org/mailman/listinfo/sword-devel<br>> <http://www.crosswire.org/mailman/listinfo/sword-devel><br>> > Instructions to unsubscribe/change your settings at above page<br>> ><br>> <br>> <br>> _______________________________________________<br>> sword-devel mailing list: sword-devel@crosswire.org<br>> <mailto:sword-devel@crosswire.org><br>> http://www.crosswire.org/mailman/listinfo/sword-devel<br>> <http://www.crosswire.org/mailman/listinfo/sword-devel><br>> Instructions to unsubscribe/change your settings at above page<br>> <br>> <br>> <br>> <br>> _______________________________________________<br>> sword-devel mailing list: sword-devel@crosswire.org<br>> http://www.crosswire.org/mailman/listinfo/sword-devel<br>> Instructions to unsubscribe/change your settings at above page<br>> <br><br><br>_______________________________________________<br>sword-devel mailing list: sword-devel@crosswire.org<br>http://www.crosswire.org/mailman/listinfo/sword-devel<br>Instructions to unsubscribe/change your settings at above page</blockquote></div>