Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apt security update

lists.debian.org

Post reply on HN
Print view View original

1–10 of 17 posts

Re: Apt security update

#3

Post by Alupis »

femtards885 wrote: post #2

Seems ironic their cert doesnt match and I get a browser warning. What happened to Debian? Is Security something they have only heard about in folklore terms?

Works fine for me. What browser are you using?

Re: Apt security update

#5

Post by Alupis »

This seems like a relatively low impact security problem. I can't recall the last time I used a package manager to get a package's source.

(Usually when I want the source it's because I'm compiling a package from source, and I get the tarball from the project's website)

Re: Apt security update

#6

Post by throwaway5583 »

femtards885 wrote: post #2

Seems ironic their cert doesnt match and I get a browser warning. What happened to Debian? Is Security something they have only heard about in folklore terms?

The cert validates for me on firefox on windows as well as iceweasel on debian.

I don't think debian is any less secure than other OSs.

Re: Apt security update

#7

Post by mcpherrinm »

Alupis wrote: post #5

This seems like a relatively low impact security problem. I can't recall the last time I used a package manager to get a package's source. (Usually when I want the source it's because I'm compiling a package from source, and I get the tarball from the project's website)

The usual case for this is when there are patches applied by the distribution.

It's also more likely to work out of the box without having to hunt for build dependencies.

This is mostly useful when you care about contributing bugfixes to the distro patches, or you can't get the upstream source to build easily.

Re: Apt security update

#9

Post by hadoukenio »

TheHippo wrote: post #8
femtards885 wrote: post #2

Seems ironic their cert doesnt match and I get a browser warning. What happened to Debian? Is Security something they have only heard about in folklore terms?

Looks fine: https://www.ssllabs.com/ssltest/analyze.html?d=lists.debian....

What about it? That's the URL for the Debian mailing list and not where packages are downloaded from.

In fact, you download packages from Debian mirrors and most of these are over HTTP and not HTTPS. How do you know you're not downloading a compromised APT? Checksums you say? Don't forget you downloaded the package footprints via HTTP too!

The MITM for APT is the elephant in the room here.

Re: Apt security update

#10

Post by TimWolla »

hadoukenio wrote: post #9
TheHippo wrote: post #8

Earlier quoted context omitted.

Looks fine: https://www.ssllabs.com/ssltest/analyze.html?d=lists.debian....

What about it? That's the URL for the Debian mailing list and not where packages are downloaded from. In fact, you download packages from Debian mirrors and most of these are over HTTP and not HTTPS. How do you know you're not downloading a compromised APT? Checksums you say? Don't forget you downloaded the package footprints via HTTP too! The MITM for APT is the elephant in the room here.

Luckily it only affected fetching the source and not the pre built binaries. Otherwise this would be a total nightmare.
Post reply on HN