{"action":"opened","issue":{"url":"https://api.github.com/repos/FABtotum/fabui-colibri/issues/198","repository_url":"https://api.github.com/repos/FABtotum/fabui-colibri","labels_url":"https://api.github.com/repos/FABtotum/fabui-colibri/issues/198/labels{/name}","comments_url":"https://api.github.com/repos/FABtotum/fabui-colibri/issues/198/comments","events_url":"https://api.github.com/repos/FABtotum/fabui-colibri/issues/198/events","html_url":"https://github.com/FABtotum/fabui-colibri/issues/198","id":250374451,"number":198,"title":"Make Colibri UI and firmware downloads/updates secure","user":{"login":"seppestas","id":1408377,"avatar_url":"https://avatars1.githubusercontent.com/u/1408377?v=4","gravatar_id":"","url":"https://api.github.com/users/seppestas","html_url":"https://github.com/seppestas","followers_url":"https://api.github.com/users/seppestas/followers","following_url":"https://api.github.com/users/seppestas/following{/other_user}","gists_url":"https://api.github.com/users/seppestas/gists{/gist_id}","starred_url":"https://api.github.com/users/seppestas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seppestas/subscriptions","organizations_url":"https://api.github.com/users/seppestas/orgs","repos_url":"https://api.github.com/users/seppestas/repos","events_url":"https://api.github.com/users/seppestas/events{/privacy}","received_events_url":"https://api.github.com/users/seppestas/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-08-15T17:00:09Z","updated_at":"2017-08-15T17:00:09Z","closed_at":null,"body":"The download link in the [installation instructions](https://github.com/FABtotum/fabui-colibri/wiki/Installation) and the configuration for the update endpoints for both [Colibri UI](https://github.com/FABtotum/fabui-colibri/blob/17817def0cfd0cd06acd30b1b3e26eb3ffa9011c/config.ini.in#L67) and [the firmware](https://github.com/FABtotum/fabui-colibri/blob/17817def0cfd0cd06acd30b1b3e26eb3ffa9011c/config.ini.in#L68) use unsecured HTTP. This allows attackers to install compromised software images and firmware using e.g a man in the middle attack or DNS spoofing on unsecured networks.\r\n\r\nAt the very least HTTPS should be used to download these files to prevent a botnet of 3D printers. Alternatively/additionally ckecksum could be calculated and placed in the wiki so people / the update mechanism can check the checksums match before copying the data on an SD card."}}
{"actor":{"display_login":"seppestas"}}