Re: Alternative Mailing list archives

[Bernd Edlinger <bernd.edlinger@hotmail.de>]

Hi Andreas,

On 4/1/20 9:44 AM, Andreas Schwab wrote:
> There are also the NNTP archives on gmane.io.  They even contain the
> full headers.
> 
> Andreas.
> 

Thanks that is also good.

BUT I have a discovered a very serious problem with the mailing lists
that must be fixed by our overseers.

That is the scubbed attachments.

As an example please look at this one:
https://marc.info/?l=gdb-patches&m=158571308379946&w=2


you see this:

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Fix-range-end-handling-of-inlined-subroutines.patch
Type: text/x-patch
Size: 10992 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/gdb-patches/attachments/20200313/5158bb87/attachment.bin>

So there are two serious problems here:

1. there is a single point of failure, if sourceware.org goes down the attachment is lost.

2. since the url is http: a man in the middle can impersonate sourceware.org and give you a
virus instead of my patch file.
It does not help that sourceware.org redirects the download to https://sourceware.org/pipermail/gdb-patches/attachments/20200313/5158bb87/attachment.bin
an attacker will not be so polite to do that.


@overseeers: PLEASE STOP IMMEDIATELY THAT SCRUBBING


Thanks
Bernd.