Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5153

Re: HTTPS needs to be implemented for updating

Show all headers | View raw

On 14527 March 1977, Christoph Biedl wrote:
> Well, this creates trust for the path until (but excluding) that
> particular mirror only. Can I trust the mirror? And even if, there's no
> guarantee the mirror got the data through a trusted path.

And why the heck would you ever trust any mirror? If you have to, you
lost already and do it wrong.

https gains you NOTHING at all. It's perfectly fine to use ANY mirror,
however untrustworthy that one may be. Because their (operators) conduct
does not matter at all. The Debian archive and its tools are setup so
that you do not need to trust them and that you notice if they do want
to f*ck with you.

As long as you
 - verified the cd image you installed from against the checksum file
   provided by the debian cd team, signed by their key,
 - do not disable signature checking in apt,
 - do not add random gpg keys to your trust store,

you are fine.

Now, if you want to manually download a .deb and dpkg -i it - then you
have to manually do the same steps apt & co do: Get the corresponding
packages and (In)Release files, verify its signature validates against
the archive key, then verify the checksum of the Packages and then the
.deb file. If you don't follow this, you lost, but you asked for it.

And before someone comes with hiding information from a sniffer: https
does not help you there, use tor to not have people know which packages
you just downloaded. https does not hide this from a sniffer.

-- 
bye, Joerg

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

HTTPS needs to be implemented for updating gwmfms06@unseen.is - 2016-12-17 21:30 +0100
  Re: HTTPS needs to be implemented for updating Christoph Moench-Tegeder <cmt@burggraben.net> - 2016-12-18 12:10 +0100
    Re: HTTPS needs to be implemented for updating datanoise <datanoise@bitjungle.info> - 2016-12-18 13:10 +0100
      Re: HTTPS needs to be implemented for updating Casper Thomsen <ct@clearhaus.com> - 2016-12-19 09:20 +0100
        Re: HTTPS needs to be implemented for updating Christoph Biedl <debian.axhn@manchmal.in-ulm.de> - 2016-12-20 23:20 +0100
          Re: HTTPS needs to be implemented for updating Joerg Jaspert <joerg@debian.org> - 2016-12-21 09:40 +0100
            Re: HTTPS needs to be implemented for updating Marc Haber <mh+debian-security@zugschlus.de> - 2016-12-21 10:00 +0100
              Re: HTTPS needs to be implemented for updating Christoph Biedl <debian.axhn@manchmal.in-ulm.de> - 2016-12-21 10:10 +0100
    Re: HTTPS needs to be implemented for updating Peter Lawler <relwalretep@gmail.com> - 2016-12-18 22:30 +0100
      Re: HTTPS needs to be implemented for updating Hans-Christoph Steiner <hans@at.or.at> - 2016-12-19 12:00 +0100
        Re: HTTPS needs to be implemented for updating Hans-Christoph Steiner <hans@at.or.at> - 2016-12-20 10:50 +0100
          Re: HTTPS needs to be implemented for updating Sven Hartge <sven@svenhartge.de> - 2016-12-20 18:20 +0100
          Re: HTTPS needs to be implemented for updating Martin Zobel-Helas <zobel@debian.org> - 2017-03-03 11:30 +0100

csiph-web