Products > Programming

Do HTTP/HTTPS servers ever enforce multipart for file downloads?

<< < (3/3)

Nominal Animal:

--- Quote from: peter-h on August 29, 2023, 10:43:46 am ---
--- Quote ---I'd use a web server under my own control.
--- End quote ---

There is a trust issue with that, from the customer's POV. If you can corrupt the cert store, all bets are off :)
--- End quote ---
If they don't trust the manufacturer, why would they trust the device?  Besides, I already described that the URLs and what they provide must be easily verifiable by the end user anyway.

In practice, you are part of the trust chain.  Externalizing that node to e.g. curl.se only makes the trust chain weaker, not stronger, and may piss off curl.se maintainers.

For a wider view of what can happen, look up NTP.  There are vendors who simply pick a subset of NTP servers – often Linux distributions' own NTP servers that have nothing to do with that vendor or the OS the vendor uses –, and hardcode the server IP or name into their product, sometimes overloading the NTP servers so much that the distro or NTP server admin changes the name and/or IP address, breaking network time updates for that vendor, who then blames the NTP server for "breaking things".  It's not a good thing, and you don't want to cause that kind of ruckus.

At minimum, you'd need to ask curl.se for permission.


--- Quote from: peter-h on August 29, 2023, 10:43:46 am ---
--- Quote --- I suppose for SSL root certs there is something to be said for "getting them straight from the source"
--- End quote ---

Exactly. Otherwise the whole business of peer authentication using certificates is bogus. You just need to install a fake DNS server and it's all yours :)

--- End quote ---
The upstream source for the Mozilla CA Certificate List is here at Mozilla Wiki, specifically the PEM of Root Certificates in Mozilla's Root Store with the Websites (TLS/SSL) Trust Bit Enabled (TXT) link.  The Wiki page includes a FAQ question on whether/how one can use the CA list.  You can use OpenSSL command-line tools on the server to parse the PEM data, to provide the same file or similar as the curl.se page does.


--- Quote from: peter-h on August 29, 2023, 10:43:46 am ---And the mfg (me) would have to maintain that server for ever, a tenner a month in reality, but there isn't a charging mechanism in place.
--- End quote ---

The "tenner a month" (it's not, it's more like a pound or two per month, and you can pay several years up front) is and should be included in the cost of the device.  I'd put any updates et cetera on the same server, possibly behind a customer-specific download key (similar to username-password pair) required for each download, that also provides an unified log of downloads and attempts (use the database the web host provides for this).

It is the cost of doing Internet-capable development kits, really.

peter-h:

--- Quote --- I'd put any updates et cetera on the same server, possibly behind a customer-specific download key (similar to username-password pair) required for each download, that also provides an unified log of downloads and attempts (use the database the web host provides for this).
--- End quote ---

That is in the future somewhere, and it isn't trivial. I think we had a thread on how to do OTA firmware updates. For example one needs to exclude large volume users (or limit them to older versions) because if one of them gets everything bricked, their lawyers can destroy your company.

Navigation

[0] Message Index

[*] Previous page

There was an error while thanking
Thanking...
Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod