clj-commons / clj-commons/aleph

Introduce less ambiguous option for disabling certificate verification?

Open
#732 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
Clojure
Stars
2.6k
Forks
242
Avg merge
4d 5h
Merged PRs (30d)
1

Description

The `insecure?` option in Aleph is somewhat ambiguous: It specifically refers to disabling TLS certificate verification but it may also be interpreted to mean to disable TLS. Perhaps it would make sense to deprecated it and introduce a more explicit new option like `disable-certificate-verification?` to resolve this. Then again, it's a pretty established name, e.g. [`clj-http`](https://github.com/dakrone/clj-http) uses it, too, and so does `curl` by way of its `--insecure` flag.

Prompted by https://github.com/clj-commons/aleph/pull/730#discussion_r1640893179

Contributor guide

Open the contributing guide

Research direction

No source file or test is named. Start by tracing the existing `insecure?` option and read the discussion referenced from pull request 730; done requires an agreed naming and deprecation direction, with the relevant behavior and tests updated accordingly.

Written by the indexing model from the issue text.

Assessment

Tech stack
clojure
Domain
networking, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.