[tz] [EXTERNAL] Re: Secure FTP support for IANA downloads

[pbassey at ups.com]

Joe,
How hard would it be for you to switch to an https download rather than FTP?

Vijay - would this (https download) satisfy the new security requirements?

-Peter

-----Original Message-----
From: Paul Eggert [mailto:eggert at cs.ucla.edu] 
Sent: Wednesday, June 06, 2018 04:47 AM
To: Bassey Peter (YSS1PXB) <pbassey at ups.com>
Cc: Time zone mailing list <tz at iana.org>; Caggiano Joseph (CLK7FFW) <josephcaggiano at ups.com>; Taylor Matt (MGT9MXT) <mxtaylor at ups.com>; Vedanabhatla Vijay (RVY4NPL) <vvedanabhatla at ups.com>; Ryabtsov Andrey (dbm1aar) <aryabtsov at ups.com>; Aronowitz Meryl (dwh1mxa) <maronowitz at ups.com>
Subject: [EXTERNAL] Re: [tz] Secure FTP support for IANA downloads

pbassey--- via tz wrote:
> Does your site offer Secure FTP for your IANA downloads and if not, 
> what would it take to enable this protocol so our company could 
> securely download your files?  Currently, we use this URL to download 
> the IANA time zone files which is not secure:ftp://ftp.iana.org/tz/

As far as I know iana.org does not offer SFTP access to tzdb, I suppose due to the relative complexity and configuration hassle associated with that protocol. 
Instead, you can access tzdb via HTTPS. This is recommended nowadays and should be just as secure as SFTP for downloads. You can also verify each release via a GPG signature for added security; this is especially recommended if you still must use plain FTP or HTTP for some reason. For details, please see:

https://mm.icann.org/pipermail/tz-announce/2018-May/000050.html