Re: HTTPS enabled Debian Security repository

From	Henrique de Moraes Holschuh <hmh@debian.org>
Newsgroups	linux.debian.security
Subject	Re: HTTPS enabled Debian Security repository
Date	2017-10-28 05:00 +0200
Message-ID	<uFpvP-4fM-1@gated-at.bofh.it> (permalink)
References	<uEM1s-3cc-5@gated-at.bofh.it> <uEM1s-3cc-9@gated-at.bofh.it> <uEV4K-l1-3@gated-at.bofh.it> <uFan8-2n7-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Fri, 27 Oct 2017, Hans-Christoph Steiner wrote:
> This idea that GPG signatures on the index files is enough has been
> totally disproven.  There was a bug in apt where Debian devices could be
> exploited by feeding them crafted InRelease files:
> 
> https://www.debian.org/security/2016/dsa-3733

This was the *one* bug of this sort in the entire lifetime of apt thus
far, AFAIK.

> If HTTPS was used, that would mean exploiting that would require

One of the dozens of zero-days already found in the TLS stack we had to
run like crazy to patch ?

In fact, the TLS stack is so complex, we can be reasonably sure there is
still at least one remotely-exploitable zero-day there.

Have you ever looked at the library stack in APT's http method, and
compared it with the one in APT's https method?

> HTTPS does not entirely solve all these problems, but it does
> drastically improve things.

That is *not* an opinion shared by everyone, to put it mildly.

-- 
  Henrique Holschuh

Thread

HTTPS enabled Debian Security repository Marek Sebera <marek.sebera@gmail.com> - 2017-10-26 10:50 +0200
  Re: HTTPS enabled Debian Security repository 林博仁 <buo.ren.lin@gmail.com> - 2017-10-26 10:50 +0200
    Re: HTTPS enabled Debian Security repository Christoph Biedl <debian.axhn@manchmal.in-ulm.de> - 2017-10-26 20:30 +0200
      Re: HTTPS enabled Debian Security repository Hans-Christoph Steiner <hans@at.or.at> - 2017-10-27 12:50 +0200
        Re: HTTPS enabled Debian Security repository Morris Taylor <morris@eml.cc> - 2017-10-27 16:00 +0200
          Re: HTTPS enabled Debian Security repository Luca Filipozzi <lfilipoz@debian.org> - 2017-10-27 16:30 +0200
        Re: HTTPS enabled Debian Security repository Henrique de Moraes Holschuh <hmh@debian.org> - 2017-10-28 05:00 +0200
          Re: HTTPS enabled Debian Security repository Ansgar Burchardt <ansgar@debian.org> - 2017-10-28 10:30 +0200
            Re: HTTPS enabled Debian Security repository Hans-Christoph Steiner <hans@at.or.at> - 2017-10-30 10:10 +0100
              Re: HTTPS enabled Debian Security repository Russell Coker <russell@coker.com.au> - 2017-10-30 12:40 +0100
                Re: HTTPS enabled Debian Security repository Rob van der Putten <rob@sput.nl> - 2017-10-31 00:40 +0100
      Re: HTTPS enabled Debian Security repository Marek Sebera <marek.sebera@gmail.com> - 2017-11-09 11:00 +0100
        Re: HTTPS enabled Debian Security repository Paul Wise <pabs@debian.org> - 2017-11-09 11:20 +0100
          Re: HTTPS enabled Debian Security repository Marek Sebera <marek.sebera@gmail.com> - 2017-11-09 11:40 +0100
            Re: HTTPS enabled Debian Security repository Paul Wise <pabs@debian.org> - 2017-11-09 12:00 +0100
  Re: HTTPS enabled Debian Security repository Paul Wise <pabs@debian.org> - 2017-10-26 11:00 +0200
  Re: HTTPS enabled Debian Security repository Tototechy <angelmarckus@rediffmail.com> - 2020-01-16 17:00 +0100

csiph-web