rsync endpoint to mirror the releases

[davglass]

Any thought on adding an rsync endpoint for this:

https://iojs.org/download/release/

[mikeal]

+1

[bengl]

+1! (but for http://nodejs.org/dist)

[rvagg]

/dist is an alias for /download/release now fwiw

[fhemberger]

Can we please add the rsync endpoint for /dist?
nodejs/nodejs.org#662 (comment)

[jbergstroem]

I can look at doing this if others in the build group agree.

[rvagg]

So I had a thought (:boom:): one of the blockers we have here is hesitation about exposing an unencrypted endpoint while we're trying to move everything to TLS (http://nodejs.org will be fully redirected soon). So, how about we be upfront about this and stand up a host named insecure.nodejs.org and expose stuff via http, rsync and even maybe ftp (does anyone still use ftp?). The name points to our opinions re security, you opt in to the risk by putting "insecure" in your scripts. We can isolate it by having the primary server push updates to it so the new host doesn't have any special access to anything. When we go fully https for nodejs.org, having an http fallback host if people absolutely need it might be a nice touch.

[jbergstroem]

@rvagg I like it. How about adding a http header about expiration as well; putting a final nail in the coffin to plaintext stuff? X-Service-Will-Expire: 2020-01-01 (or the rsync equivalent in message)

[jbergstroem]

(as well as serving the same message with /index.html)

[mhdawson]

Would unencrypted.nodejs.org work ? Not to bikeshed but insecure implies a lot more to me than just not protected by encryption which I think would be the main difference.