search

littlebizzy / slickstack

Lightning-fast WordPress on Nginx
https://slickstack.io
GNU General Public License v3.0
629 stars 112 forks source link

Consider removing --no-check-certificate flag from wget function #86

Closed Bronislawsky closed 3 years ago

Bronislawsky commented 3 years ago

Issue or not, I believe this could be a security issue since scripts are periodically updated, to avoid a MitM attack, I would think --no-check-certificate should be removed.

jessuppi commented 3 years ago

Thanks @Bronislawsky

Honestly we probably won't ever change this, as our mirrors are HTTP (not HTTPS) so the point is moot. We only include the option there --no-check-certificate for people who customize their ss-config options and probably don't know much about shell scripting... e.g. that wget will fail if their download sources are behind SSL.

jessuppi commented 3 years ago

Here is an example of our mirrors (notice non-SSL link): http://mirrors.slickstack.io/ss-check.txt

jessuppi commented 3 years ago

For future reference, most SlickStack bash command functions (and their flags) are defined in ss-functions:

https://github.com/littlebizzy/slickstack/blob/master/bash/ss-functions.txt