<div><span style="color: rgb(160, 160, 168); ">On Wednesday, February 6, 2013 at 7:22 PM, martin@v.loewis.de wrote:</span></div>
<blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;">
<span><div><div><div><br></div><div>Zitat von Jacob Kaplan-Moss <<a href="mailto:jacob@jacobian.org">jacob@jacobian.org</a>>:</div><div><br></div><blockquote type="cite"><div><div>On Wed, Feb 6, 2013 at 5:45 PM, <<a href="mailto:martin@v.loewis.de">martin@v.loewis.de</a>> wrote:</div><blockquote type="cite"><div><div>I see. Still, it's not a problem at the moment; "<a href="http://python.org">python.org</a>" does not issue</div><div>cookies. Even for the new site, it should be possible to find a secure</div><div>solution</div><div>that doesn't involve shutting down <a href="http://packages.python.org">packages.python.org</a>.</div></div></blockquote><div><br></div><div>Sadly, the only "secure solution" would be to not issue cookies, i.e.</div><div>have no login components, and that's not what's required of the new</div><div>site.</div></div></blockquote><div><br></div><div>Why is that? If the issue is for "<a href="http://www.python.org">www.python.org</a>", then <a href="http://packages.python.org">packages.python.org</a></div><div>cannot steal it, can it?</div></div></div></span></blockquote><div>Session Fixation. </div><blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;"><span><div><div><div><br></div><blockquote type="cite"><div><div>So something's gotta give here. Our options are basically:</div><div><br></div><div>* Don't launch the new site as spec'd; revise the scope to be</div><div>completely static and have no login components.</div><div><br></div><div>* Make <a href="http://packages.python.org">packages.python.org</a> strip javascript and quite possibly certain</div><div>HTML as well (I think it has to strip forms to prevent CSRF, but I</div><div>haven't thought that through completely).</div><div><br></div><div>* Move <a href="http://packages.python.org">packages.python.org</a> to a new TLD.</div></div></blockquote><div><br></div><div>There are certainly more options:</div><div>- don't use cookies 1: use basic auth instead</div></div></div></span></blockquote><div>Horrible UX, hope you didn't want CSRF protection either because</div><div>you throw that right out. </div><blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;"><span><div><div><div>- don't use cookies 2: use TLS session IDs instead</div></div></div></span></blockquote><div>Pretty sure these are passed cleartext, hope you didn't want your</div><div>sessions MITM'd </div><blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;"><span><div><div><div>- don't use cookies 3: use X.509 certificates instead</div></div></div></span></blockquote><div>Hope you didn't want CSRF protection, Also hope you didn't</div><div>want PyPI protected from session fixation. Or if you're</div><div>moving PyPI to X.509 certs too have fun supporting all</div><div>those users. </div><blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;"><span><div><div><div>- move the login site to a new TLD (e.g. <a href="http://python-cms.org">python-cms.org</a>)</div></div></div></span></blockquote><div>Hope you didn't want CSRF protection on python.org, or any</div><div>of this protected against PyPI. </div><blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;"><span><div><div><div><br></div><div>I'm not saying that all these options are practical, I'm just pointing</div><div>out that there are definitely more than the three you've mentioned.</div><div><br></div><div>"Move to a new TLD" is much better than "tell people to go elsewhere",</div><div>though.</div><div><br></div><div>Regards,</div><div>Martin</div></div></div></span>
</blockquote>
<div>
Instead of trying to preform gymnastics to keep packages.python.org just
</div><div>keep it as is and move it to a new domain. It's simple, it's effective, and it</div><div>doesn't require horrible bandaids that don't completely solve the issue anyways.</div>