Joe, How hard would it be for you to switch to an https download rather than FTP? Vijay - would this (https download) satisfy the new security requirements? -Peter -----Original Message----- From: Paul Eggert [mailto:eggert@cs.ucla.edu] Sent: Wednesday, June 06, 2018 04:47 AM To: Bassey Peter (YSS1PXB) <pbassey@ups.com> Cc: Time zone mailing list <tz@iana.org>; Caggiano Joseph (CLK7FFW) <josephcaggiano@ups.com>; Taylor Matt (MGT9MXT) <mxtaylor@ups.com>; Vedanabhatla Vijay (RVY4NPL) <vvedanabhatla@ups.com>; Ryabtsov Andrey (dbm1aar) <aryabtsov@ups.com>; Aronowitz Meryl (dwh1mxa) <maronowitz@ups.com> Subject: [EXTERNAL] Re: [tz] Secure FTP support for IANA downloads pbassey--- via tz wrote:
Does your site offer Secure FTP for your IANA downloads and if not, what would it take to enable this protocol so our company could securely download your files? Currently, we use this URL to download the IANA time zone files which is not secure:ftp://ftp.iana.org/tz/
As far as I know iana.org does not offer SFTP access to tzdb, I suppose due to the relative complexity and configuration hassle associated with that protocol. Instead, you can access tzdb via HTTPS. This is recommended nowadays and should be just as secure as SFTP for downloads. You can also verify each release via a GPG signature for added security; this is especially recommended if you still must use plain FTP or HTTP for some reason. For details, please see: https://mm.icann.org/pipermail/tz-announce/2018-May/000050.html