Does not work with https about flatpak.github.io HOT 8 CLOSED

Should be working now. HSTS redirecting http -> https.

from flatpak.github.io.

Please use HTTPS. It is re4ally basic and in this case even security-critical as on http://flatpak.org/apps.html there are links to executables. The links itself are HTTPS, that's fine, but as the links are embedded on a HTTP website, any (MITM-attacker) can modify them to point somewhere else.

And these *.flatpakref files are critical as they include the GPG key to sign the updates and the URLs to the website where updates are downloaded. So HTTPS here is not 0only "nice to have", it is essential for the whole security of these flatpaks as the downloaded *.flatpakref files are the first point, where the "security chain" starts and currently it is incomplete. Without HTTPS on this site all your flatpak applications can be MITM-attacked and arbitrary code can be executed. (hopefully only in flatpaks itself, but anyway)

from flatpak.github.io.

We're using github project pages with a custom domain, and this doesn't currently allow https.

Are you sure this cannot be fixed? I think it is important for a project such as Flatpak to be secure on all fronts. I generally do not download from http-only sites.

from flatpak.github.io.

Stop using Github Pages if it won't support HTTPS. Setting up a simple nginx webserver for a static site takes less than an hour if you're at all competent.

from flatpak.github.io.

bump This is a critical security issue

from flatpak.github.io.

We're using github project pages with a custom domain, and this doesn't currently allow https.

from flatpak.github.io.

According to some comments on isaacs/github#156 it might be possible to use Cloudflare to make this happen.

from flatpak.github.io.

More info here: https://blog.cloudflare.com/secure-and-fast-github-pages-with-cloudflare/

from flatpak.github.io.