Files
task/website
Valentin Maerten dfc530e97e fix(remote): allow a downgrade redirect under --insecure
Refusing it unconditionally was security theatre: --insecure also sets
InsecureSkipVerify, so an attacker in position to intercept can already
serve anything over the https leg with a self-signed certificate. It also
broke an internal server that redirects and works today.

--insecure now means one thing everywhere: the transport guarantees are
waived.
2026-08-23 13:29:09 +02:00
..
2026-08-18 17:14:13 +02:00