• Show log

    Commit

  • Hash : 3562e384
    Author : Paul Eggert
    Date : 2017-09-16T13:03:36

    Prefer https: URLs
    
    In Gnulib, Emacs, etc. we are changing ftp: and http: URLs to use
    https:, to discourage man-in-the-middle attacks when downloading
    software. The attached patch propagates these changes upstream to
    Automake.  This patch does not affect files that Automake is
    downstream of, which I'll patch separately.
    
    Althouth the resources are not secret, plain HTTP is vulnerable to
    malicious routers that tamper with responses from GNU servers,
    and this sort of thing is all too common when people in some other
    countries browse US-based websites. See, for example:
    
    Aceto G, Botta A, Pescapé A, Awan MF, Ahmad T, Qaisar
    S. Analyzing internet censorship in Pakistan. RTSI
    2016. https://dx.doi.org/10.1109/RTSI.2016.7740626
    
    HTTPS is not a complete solution here, but it can be a significant
    help. The GNU project regularly serves up code to users, so we should
    take some care here.
    

  • README

  • "Plans" for future or on-going Automake development.
    
    The contents is meant to help ensure a more controlled and smooth
    development and evolution for Automake, in several ways.
    
     - Having the plans clearly spelled out should will avoid messy
       roadmaps with no clear way forward or with muddy or ill-defined
       aims or purposes; a trap this is too easy to fall into.
    
     - Keeping planned changes cooking and re-hashed for a while should
       ensure rough edges are smoothed up, transitions are planned in a
       proper way (hopefully avoiding debacles like the AM_MKDIR_PROG_P
       deprecation and the AM_CONFIG_HEADER too-abrupt removal), and
       "power users" have more chances of getting informed in due time,
       thus having all the time to prepare for the changes or raise
       objections against them.
    
     - Having the plans clearly stated and registered in a "centralized"
       location should make it more difficult to them to slip through
       the cracks, getting forgotten or (worse) only half-implemented.
    
     - Even for discussions and plans registered on the Bug Tracker
       as well, a corresponding entry in the PLANS directory can help
       in keeping main ideas summarized, and consensus and/or objections
       registered and easily compared.