Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.devel > #102723
| From | Hans-Christoph Steiner <hans@eds.org> |
|---|---|
| Newsgroups | linux.debian.bugs.dist, linux.debian.devel |
| Subject | Bug#992692: next steps |
| Date | 2021-12-09 12:30 +0100 |
| Message-ID | <DspMB-lU-3@gated-at.bofh.it> (permalink) |
| References | <COVoC-1JB-21@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Cross-posted to 2 groups.
I fully support the idea that HTTPS should become the default for apt repos. From what I gather, the open question is how best to handle auto-apt-proxy configuration. There seems to be a number of reasonable proposals: * Make auto-apt-proxy set "Acquire::https::Verify-Peer false;" * automate setting http at install time using preseed with auto-apt-proxy asking this as a debconf question. * Users can always later edit the sources.list. In the context of a BSP or DebConf, that is a very reasonable thing to ask. auto-apt-proxy sounds like a nice feature, but it also adds security risks. We also need to consider that. Users should get best practice security without thinking about it at all. That's HTTPS these days, despite its imperfections. Not defaulting to HTTPS means people have to be aware that HTTP is the default, then consider using HTTPS. We should of course make it as easy as possible to use caching proxies, that also comes with a responsibility in making the sure aware that it adds small but present security risks. So a debconf question in auto-apt-proxy seems like a good place for that. For those who think that apt's GPG verification is enough, consider these CVEs: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1358 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1829 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3587 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1252 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0501 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3462 For more on this whole topic, I wrote up a blog post based on my previous research and these ongoing discussions: https://guardianproject.info/2021/12/08/debian-over-https/
Back to linux.debian.devel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Bug#992692: general: Use https for {deb,security}.debian.org by default Hideki Yamane <henrich@debian.org> - 2021-08-22 15:10 +0200
Processed: Re: Bug#992692: general: Use https for {deb,security}.debian.org by default "Debian Bug Tracking System" <owner@bugs.debian.org> - 2021-09-01 11:50 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Helmut Grohne <helmut@subdivi.de> - 2021-09-01 11:50 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-01 12:00 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Russ Allbery <rra@debian.org> - 2021-09-01 17:00 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Hideki Yamane <henrich@iijmio-mail.jp> - 2021-09-02 04:00 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Roberto C. Sánchez <roberto@debian.org> - 2021-09-02 18:30 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Jeremy Stanley <fungi@yuggoth.org> - 2021-09-02 19:00 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Jeremy Stanley <fungi@yuggoth.org> - 2021-09-02 19:00 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Simon Richter <sjr@debian.org> - 2021-09-02 21:40 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-02 23:10 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Paul Wise <pabs@debian.org> - 2021-09-03 04:50 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default David Kalnischkies <david@kalnischkies.de> - 2021-09-05 12:40 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Simon Richter <sjr@debian.org> - 2021-09-03 13:20 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-03 13:40 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Philipp Kern <pkern@debian.org> - 2021-09-03 13:40 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Hideki Yamane <henrich@iijmio-mail.jp> - 2021-09-04 22:20 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Simon Richter <sjr@debian.org> - 2021-09-09 20:10 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Paul Wise <pabs@debian.org> - 2021-09-10 02:00 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Simon Richter <sjr@debian.org> - 2021-09-10 17:10 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Helmut Grohne <helmut@subdivi.de> - 2021-09-08 13:20 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-08 13:40 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Helmut Grohne <helmut@subdivi.de> - 2021-09-08 14:00 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-08 14:10 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Helmut Grohne <helmut@subdivi.de> - 2021-09-08 15:50 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-08 16:00 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Michael Stone <mstone@debian.org> - 2021-09-09 01:30 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Timothy M Butterworth <timothy.m.butterworth@gmail.com> - 2021-09-09 01:40 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Eduard Bloch <edi@gmx.de> - 2021-09-10 11:30 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Timo Röhling <roehling@debian.org> - 2021-09-10 12:10 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Michael Stone <mstone@debian.org> - 2021-09-10 14:00 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Tim Woodall <debiandevel@woodall.me.uk> - 2021-09-08 14:20 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-08 14:30 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Michael Stone <mstone@debian.org> - 2021-09-09 01:30 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Timo Röhling <roehling@debian.org> - 2021-09-09 08:40 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Michael Stone <mstone@debian.org> - 2021-09-09 14:40 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Timo Röhling <roehling@debian.org> - 2021-09-09 15:00 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Michael Stone <mstone@debian.org> - 2021-09-09 15:10 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Timo Röhling <roehling@debian.org> - 2021-09-09 15:30 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Michael Stone <mstone@debian.org> - 2021-09-09 15:00 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default David Kalnischkies <david@kalnischkies.de> - 2021-09-10 16:40 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Michael Stone <mstone@debian.org> - 2021-09-10 17:10 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default David Kalnischkies <david@kalnischkies.de> - 2021-09-10 20:10 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Michael Stone <mstone@debian.org> - 2021-09-10 21:20 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Paul Wise <pabs@debian.org> - 2021-09-12 05:20 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Holger Levsen <holger@layer-acht.org> - 2021-09-13 00:00 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default David Kalnischkies <david@kalnischkies.de> - 2021-09-13 15:10 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Helmut Grohne <helmut@subdivi.de> - 2021-09-10 09:40 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-10 10:20 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Michael Stone <mstone@debian.org> - 2021-09-10 14:10 +0200
Bug#994409: task-laptop: please recommend automatic apt proxying Phil Morrell <debian@emorrp1.name> - 2021-09-15 19:20 +0200
Re: task-laptop: please recommend automatic apt proxying Russ Allbery <rra@debian.org> - 2021-09-15 19:40 +0200
Re: task-laptop: please recommend automatic apt proxying Russ Allbery <rra@debian.org> - 2021-09-15 19:40 +0200
Bug#992692: next steps Hans-Christoph Steiner <hans@eds.org> - 2021-12-09 12:30 +0100
Bug#992692: more steps towards this goal Hans-Christoph Steiner <hans@eds.org> - 2022-03-30 10:00 +0200
Bug#992692: moar Hans-Christoph Steiner <hans@eds.org> - 2022-03-30 12:30 +0200
Bug#992692: link Geert Stappers <stappers@stappers.nl> - 2022-03-30 12:50 +0200
csiph-web