Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1070601
| From | Ansgar <ansgar@43-1.org> |
|---|---|
| Newsgroups | linux.debian.bugs.dist, linux.debian.devel |
| Subject | Bug#992692: general: Use https for {deb,security}.debian.org by default |
| Date | 2021-09-10 10:20 +0200 |
| Message-ID | <CVJVn-2uS-3@gated-at.bofh.it> (permalink) |
| References | (5 earlier) <CV3Mu-1jd-9@gated-at.bofh.it> <CVfaV-8ll-7@gated-at.bofh.it> <CVJiG-1ZD-5@gated-at.bofh.it> <COVoC-1JB-21@gated-at.bofh.it> <CVJiG-1ZD-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Cross-posted to 2 groups.
On Fri, 2021-09-10 at 09:33 +0200, Helmut Grohne wrote: > If > we installed auto-apt-proxy by default, much of the local caching > would > just work. If you push for a local caching method to be used by default, apt should always request (In)Release.gpg from a regular mirror (not auto- discovered local cache), preferably via HTTPS; for subsequent data (which apt can verify via (In)Release) a local mirror can be used, falling back to the regular mirror when the data provided by the local cache is not correct for any reason. Especially at BSPs where people are likely to bootstrap new environments (via debootstrap, for example for building packages) we would allow downgrade attacks otherwise: (In)Release for stable releases has no Valid-Until, so any initial (In)Release file can be substituted by the cache operator for an older one which then refers to known-vulnerable packages. (And I'm not sure debootstrap even checks Valid-Until.) Ansgar
Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Bug#992692: general: Use https for {deb,security}.debian.org by default Helmut Grohne <helmut@subdivi.de> - 2021-09-08 13:20 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-08 13:40 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Helmut Grohne <helmut@subdivi.de> - 2021-09-08 14:00 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-08 14:10 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Helmut Grohne <helmut@subdivi.de> - 2021-09-08 15:50 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-08 16:00 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Tim Woodall <debiandevel@woodall.me.uk> - 2021-09-08 14:20 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-08 14:30 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Michael Stone <mstone@debian.org> - 2021-09-09 01:30 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Timo Röhling <roehling@debian.org> - 2021-09-09 08:40 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Michael Stone <mstone@debian.org> - 2021-09-09 14:40 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Timo Röhling <roehling@debian.org> - 2021-09-09 15:00 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Michael Stone <mstone@debian.org> - 2021-09-09 15:10 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Timo Röhling <roehling@debian.org> - 2021-09-09 15:30 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Helmut Grohne <helmut@subdivi.de> - 2021-09-10 09:40 +0200
Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-10 10:20 +0200
Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Michael Stone <mstone@debian.org> - 2021-09-10 14:10 +0200
Bug#994409: task-laptop: please recommend automatic apt proxying Phil Morrell <debian@emorrp1.name> - 2021-09-15 19:20 +0200
Re: task-laptop: please recommend automatic apt proxying Russ Allbery <rra@debian.org> - 2021-09-15 19:40 +0200
Bug#994409: +1 (Re: task-laptop: please recommend automatic apt proxying) Holger Levsen <holger@layer-acht.org> - 2021-09-15 19:50 +0200
csiph-web