{"action":"created","issue":{"url":"https://api.github.com/repos/caskroom/homebrew-cask/issues/10377","labels_url":"https://api.github.com/repos/caskroom/homebrew-cask/issues/10377/labels{/name}","comments_url":"https://api.github.com/repos/caskroom/homebrew-cask/issues/10377/comments","events_url":"https://api.github.com/repos/caskroom/homebrew-cask/issues/10377/events","html_url":"https://github.com/caskroom/homebrew-cask/issues/10377","id":65972035,"number":10377,"title":"Executable code loaded over an insecure channel (High Risk)","user":{"login":"TheRook","id":521783,"avatar_url":"https://avatars.githubusercontent.com/u/521783?v=3","gravatar_id":"","url":"https://api.github.com/users/TheRook","html_url":"https://github.com/TheRook","followers_url":"https://api.github.com/users/TheRook/followers","following_url":"https://api.github.com/users/TheRook/following{/other_user}","gists_url":"https://api.github.com/users/TheRook/gists{/gist_id}","starred_url":"https://api.github.com/users/TheRook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TheRook/subscriptions","organizations_url":"https://api.github.com/users/TheRook/orgs","repos_url":"https://api.github.com/users/TheRook/repos","events_url":"https://api.github.com/users/TheRook/events{/privacy}","received_events_url":"https://api.github.com/users/TheRook/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-04-02T17:23:25Z","updated_at":"2015-04-03T09:38:47Z","closed_at":null,"body":"When downloading executable code from SourceForge brew choose to use an insecure channel (http), which is vulnerable to a man-in-the-middle attack. The transmission of executable code over HTTP is extremely hazardous as it leads to remote code execution. The following insecure behavior was observed:\r\n\r\n```\r\n~> brew install Caskroom/cask/filezilla\r\n==> brew cask install Caskroom/cask/filezilla\r\n==> Downloading http://downloads.sourceforge.net/project/filezilla/FileZilla_Client/3.10.3/FileZilla_3.10.3_macosx-x86.app.tar.bz2\r\n```\r\n\r\nBrew was installed on one our high security systems. A vulnerability which leads to remote code execution on this system is unacceptable, and we are forced to uninstall brew until this high risk issue is addressed."},"comment":{"url":"https://api.github.com/repos/caskroom/homebrew-cask/issues/comments/89237006","html_url":"https://github.com/caskroom/homebrew-cask/issues/10377#issuecomment-89237006","issue_url":"https://api.github.com/repos/caskroom/homebrew-cask/issues/10377","id":89237006,"user":{"login":"radeksimko","id":287584,"avatar_url":"https://avatars.githubusercontent.com/u/287584?v=3","gravatar_id":"","url":"https://api.github.com/users/radeksimko","html_url":"https://github.com/radeksimko","followers_url":"https://api.github.com/users/radeksimko/followers","following_url":"https://api.github.com/users/radeksimko/following{/other_user}","gists_url":"https://api.github.com/users/radeksimko/gists{/gist_id}","starred_url":"https://api.github.com/users/radeksimko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/radeksimko/subscriptions","organizations_url":"https://api.github.com/users/radeksimko/orgs","repos_url":"https://api.github.com/users/radeksimko/repos","events_url":"https://api.github.com/users/radeksimko/events{/privacy}","received_events_url":"https://api.github.com/users/radeksimko/received_events","type":"User","site_admin":false},"created_at":"2015-04-03T09:38:47Z","updated_at":"2015-04-03T09:38:47Z","body":"@ndr-qef True, but I agree with @TheRook that HTTPS should be always preferred as long as the URL **(even after x redirects)** gives you the package. If the vendor redirects from HTTPS to HTTP, we can treat that as their own fault and if anyone in the future will complain about that, we can point to the vendor. We may eventually end up having a stronger voice for `HTTP->301->HTTPS`.\r\n\r\nWe (as Cask maintainers) should be just doing as much as we can."}}