2015-01-16, 11:43
Hello,
You have http://kodi.tv/contribute/donate-by-wire-transfer/ and I think it's rather irresponsible behaviour to put account numbers on an insecure page. Wire transfers aren't "secure" in a sense that if you send your money to a fraudster, your chances of getting the money back are close to zero (unlike when paying with a credit card).
You (the people running the kodi.tv internals) probably can even get a certificate for free: https://www.globalsign.com/en/ssl/ssl-open-source/ so it's not a question of cost.
If you don't have experience on setting up https, and need help, I can help. I can come to irc or whatever at a suitable time to answer any question on regarding setting up https (also, if you want a quick audit on some basic stuff for running servers reasonably securely so you don't end up like Sony, I can also do that). I do stuff like that for a living, and although we don't use debian at work, I've been using debian and debian based distros on my personal computers for ages.
(P.S. security wise best practice is not to advertise what you're running. http://httpd.apache.org/docs/2.2/mod/cor...rvertokens )
You have http://kodi.tv/contribute/donate-by-wire-transfer/ and I think it's rather irresponsible behaviour to put account numbers on an insecure page. Wire transfers aren't "secure" in a sense that if you send your money to a fraudster, your chances of getting the money back are close to zero (unlike when paying with a credit card).
You (the people running the kodi.tv internals) probably can even get a certificate for free: https://www.globalsign.com/en/ssl/ssl-open-source/ so it's not a question of cost.
If you don't have experience on setting up https, and need help, I can help. I can come to irc or whatever at a suitable time to answer any question on regarding setting up https (also, if you want a quick audit on some basic stuff for running servers reasonably securely so you don't end up like Sony, I can also do that). I do stuff like that for a living, and although we don't use debian at work, I've been using debian and debian based distros on my personal computers for ages.
(P.S. security wise best practice is not to advertise what you're running. http://httpd.apache.org/docs/2.2/mod/cor...rvertokens )
