search

r-universe-org / help

Support and bug tracker for R-universe
https://docs.r-universe.dev/
8 stars 2 forks source link

Security alert when trying to open Lionel Henry's R-universe #127

Closed maelle closed 2 years ago

maelle commented 2 years ago

I.e. in Firefox for https://lionel-.r-universe.dev/

I see an alert.

It seems the SSL certificate wildcard does not encompass the "lionel-"

Pardon my French:

Les sites web justifient leur identité par des certificats. Firefox ne fait pas confiance à ce site, car il utilise un certificat qui n’est pas valide pour lionel-.r-universe.dev. Le certificat est seulement valide pour les noms suivants : *.r-universe.dev, r-universe.dev

Code d’erreur : SSL_ERROR_BAD_CERT_DOMAIN

maelle commented 2 years ago

For me on Firefox https://lionel-.github.io/ also produces an error.

jeroen commented 2 years ago

Oh you are right. OK so there is probably little I can do... perhaps this is some sort of fishing protection?

maelle commented 2 years ago

https://bugzilla.mozilla.org/show_bug.cgi?id=1184059

maelle commented 2 years ago

Not sure you want to have a fix for one user but could this R-universe be redirected to something? Something that would not clash with any other username.

maelle commented 2 years ago

For the record, as stated in the bugzilla thread from above, these days on GitHub a new username cannot start nor end with a hyphen.

image

jeroen commented 2 years ago

Thanks, that's a good find. I don't think we can do a redirect because firefox refuses to connect to the domain, so we can't even send a redirect.

We could host a special page e.g. lionel_.r-universe.dev but then all the automatically generated links everywhere have to be fixed as well because lionel- turns op as a contributior in many packages...

maelle commented 2 years ago

I'm not sure the underscore is a good idea, it looks like it could be a problem too. :wink:

jeroen commented 2 years ago

I don't think there is much we can do about this. As said, the same problem appears for https://lionel-.github.io. It is a very unfortunate edge case for legacy github usernames, that is beyond our control. Hopefully @lionel- can find a way to fix a better username.