Metadata requireSignedMetadata=false Behavior

[Nate Klingenstein]

If you know enough to see through the statement then you stand a reasonably good chance of deploying TLS in a secure manner

That argument would carry the day with me in every regard so long as the various documentation was a little more clear that this is not a limitation of the implementation or specification.

I think that it's fair to say that there is significant concern amongst the developers at the "TLS is magic-secure-pixie-dust" mindset which is inferred by trusting the CA bundle distributed in the JVM.

It’s totally magic and secure.  I snorted some yesterday and I still feel as diaphenous as the wind.

HTH - and please keep up the feedback, it is our best chance to improve things.

This was enormously helpful, thanks.  I’ll do my best to keep whining.  You may have noticed it comes naturally to deployers. :D

More generally, this seems like the kind of “breaking" configuration change that I think would have been very valid to have been made between v2 and v3, especially as it’s literally a brand new file.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150607/00f5ff9b/attachment.html>