Hi -
nathans wrote:
> > - mention the possibility of self-signed certificates, possibly
> > working out an example
>
> You mean above and beyond the self-signed cert used in the example,
> I'm sure.
I only see "obtain and install a certificate ..." in the writeup, not
anything about *how*.
> Is that really a valid way to set up a realistic server? [...]
It's obviously not applicable everywhere, but in other places, it's
better than no encryption at all.
> [...]
> > - consider defaulting to PCP_SECURE_SOCKETS=1
>
> The semantics of that env var are that if a secure connection cannot
> be established, the connection fails. [...]
That could be changed, or a different value could be invented with a
"prefer but not require ssl" meaning. The idea would be to get a
as-secure-as-possible-by-default kind of situation.
- FChE
|