{"action":"created","issue":{"url":"https://api.github.com/repos/Homebrew/homebrew/issues/38835","labels_url":"https://api.github.com/repos/Homebrew/homebrew/issues/38835/labels{/name}","comments_url":"https://api.github.com/repos/Homebrew/homebrew/issues/38835/comments","events_url":"https://api.github.com/repos/Homebrew/homebrew/issues/38835/events","html_url":"https://github.com/Homebrew/homebrew/pull/38835","id":69461434,"number":38835,"title":"Declare Insecure Redirects","user":{"login":"DomT4","id":6998367,"avatar_url":"https://avatars.githubusercontent.com/u/6998367?v=3","gravatar_id":"","url":"https://api.github.com/users/DomT4","html_url":"https://github.com/DomT4","followers_url":"https://api.github.com/users/DomT4/followers","following_url":"https://api.github.com/users/DomT4/following{/other_user}","gists_url":"https://api.github.com/users/DomT4/gists{/gist_id}","starred_url":"https://api.github.com/users/DomT4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DomT4/subscriptions","organizations_url":"https://api.github.com/users/DomT4/orgs","repos_url":"https://api.github.com/users/DomT4/repos","events_url":"https://api.github.com/users/DomT4/events{/privacy}","received_events_url":"https://api.github.com/users/DomT4/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":41,"created_at":"2015-04-19T20:30:29Z","updated_at":"2015-04-29T02:40:52Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/Homebrew/homebrew/pulls/38835","html_url":"https://github.com/Homebrew/homebrew/pull/38835","diff_url":"https://github.com/Homebrew/homebrew/pull/38835.diff","patch_url":"https://github.com/Homebrew/homebrew/pull/38835.patch"},"body":"Re discussion in #38824."},"comment":{"url":"https://api.github.com/repos/Homebrew/homebrew/issues/comments/97287812","html_url":"https://github.com/Homebrew/homebrew/pull/38835#issuecomment-97287812","issue_url":"https://api.github.com/repos/Homebrew/homebrew/issues/38835","id":97287812,"user":{"login":"DomT4","id":6998367,"avatar_url":"https://avatars.githubusercontent.com/u/6998367?v=3","gravatar_id":"","url":"https://api.github.com/users/DomT4","html_url":"https://github.com/DomT4","followers_url":"https://api.github.com/users/DomT4/followers","following_url":"https://api.github.com/users/DomT4/following{/other_user}","gists_url":"https://api.github.com/users/DomT4/gists{/gist_id}","starred_url":"https://api.github.com/users/DomT4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DomT4/subscriptions","organizations_url":"https://api.github.com/users/DomT4/orgs","repos_url":"https://api.github.com/users/DomT4/repos","events_url":"https://api.github.com/users/DomT4/events{/privacy}","received_events_url":"https://api.github.com/users/DomT4/received_events","type":"User","site_admin":false},"created_at":"2015-04-29T02:40:52Z","updated_at":"2015-04-29T02:40:52Z","body":"> This is particularly important to browsers because people make decisions about entering their credit card number or their password based on looking at a URL, which isn't the case here.\r\n\r\nIf it were as black-and-white as this, there would be no justification for any download server to serve anything over secure channels. Encryption has a broader use and [push](http://www.wired.com/2014/04/https/) beside just protecting the obvious. Both the IAB and IETF have decried plaintext connections inside the last year, re the IETF:\r\n\r\n> User trust is critical to the Internet's continued growth and evolution. Realizing the IAB's aspiration would drastically reduce the ability to eavesdrop or modify information sent over the Internet.\r\n\r\nBetween this thread, the last one, and the one over at the Caskroom there's been enough conflicting ideas that there's a fairly decent chance we all throw around different ideas and implementations for months whilst the issue persists. I just tried to land on a middle ground here :neutral_face:.\r\n\r\nSadly, re Jack's suggestion in [this comment](https://github.com/Homebrew/homebrew/pull/38835#issuecomment-95772259) we do break *at least* Apache downloads. The reasonable thing to do consequently is scope it, but that means we won't see the actual download URL for every formulae, so it's not a huge debug gain.\r\n\r\nIt also doesn't give the user any actual *choice* in the matter - Before they are notified where the download is coming from, it has already happened; If you didn't want a plaintext download, tough, it's finished. *\"Hey this isn't a secure link, and we're gonna tell you about it, but you're stuck with it\"* isn't great UX either.\r\n\r\n```diff\r\ndiff --git a/Library/Homebrew/download_strategy.rb b/Library/Homebrew/download_strategy.rb\r\nindex d270ec4..86be24d 100644\r\n--- a/Library/Homebrew/download_strategy.rb\r\n+++ b/Library/Homebrew/download_strategy.rb\r\n@@ -317,8 +317,11 @@ class CurlDownloadStrategy < AbstractFileDownloadStrategy\r\n   end\r\n\r\n   def curl(*args)\r\n+    insecure_redirects = @url.include?(\"https://downloads.sourceforge.net\") || @url.include?(\"https://download.gnome\")\r\n+\r\n     args << '--connect-timeout' << '5' unless mirrors.empty?\r\n     args << \"--user\" << meta.fetch(:user) if meta.key?(:user)\r\n+    args << \"-w\" << \"Downloaded from: %{url_effective}\\n\" if insecure_redirects\r\n     super\r\n   end\r\n end\r\n```\r\n\r\nWhatever we do, we're not going to hit a perfect solution because we're forced to work with the hand upstream has dealt us. We just have to decide on the least-sucky, most-effective, least-breaky solution."}}