This is Sonatype's response to the earlier "How to take over the computer of any Java (or Clojure or Scala) developer" concerns and discussion [1]. I'm very relieved they've fixed the big problem there, as having so much infrastructure reliant on plain HTTP was a giant hack waiting to happen.

[1] https://news.ycombinator.com/item?id=8099713

> extremely short turnaround time

Come on, please. Sonatype had HTTPS intentionally only for Nexus/Artifactory/… users since at least 2007.

Except that this does not really give you that much security. Maybe only in the transport, but certainly not verification of content.

HTTPS (or SSL/TLS for that matter) only verifies the identity of the server the content is coming from. Since users can upload stuff to repositories on Sonatype, there is no verification of content whatsoever.

A naive workaround of this is to use PGP signed content. This would work, if users actually verified the PGP signature through a third channel. Either using web of trust, or some other means of getting a verification that the PGP key actually belongs to the developer.

Failing that, HTTPS is just snake-oil security here.

Thanks guys for the great work!

Is it enough? http://blog.bintray.com/2014/08/04/feel-secure-with-ssl-thin...

Public shaming works!