Re: HTTPS enabled Debian Security repository

From	Russell Coker <russell@coker.com.au>
Newsgroups	linux.debian.security
Subject	Re: HTTPS enabled Debian Security repository
Date	2017-10-30 12:40 +0100
Message-ID	<uGgAa-4Xw-7@gated-at.bofh.it> (permalink)
References	<uEM1s-3cc-5@gated-at.bofh.it> <uFuFb-7Od-1@gated-at.bofh.it> <uGef0-3Dz-13@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Monday, 30 October 2017 8:57:00 AM AEDT Hans-Christoph Steiner wrote:
> > The one from 2016 is harder to exploit: I asked on #-apt back then and
> > the sample exploit had a 1/4 success change with a 1.3 GB InRelease file
> > on a memory starved i386 system).
> 
> That hit rate is enough to build malware around...

25% hit rate is enough to be worth exploiting, but 1.3G of extra data greatly 
reduces the incidence.  The small i386 systems tend not to have fast enough 
networking that 1.3G of data could be downloaded without notice.

> Don't get me wrong, I agree that HTTPS is very overcomplicated and
> terrible in a lot of ways.  But the days of plain HTTP/TCP are over.
> All connections need to be moving towards encryption.  Even with HTTPS'
> faults, we are better off using it than plain HTTP.

I agree.  There's little downside nowadays.  Squid doesn't work particularly 
well caching APT repositories nowadays (strange timeouts and hangs during 
downloads) so the caching benefit of non-SSL has mostly gone away.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/

Thread

HTTPS enabled Debian Security repository Marek Sebera <marek.sebera@gmail.com> - 2017-10-26 10:50 +0200
  Re: HTTPS enabled Debian Security repository 林博仁 <buo.ren.lin@gmail.com> - 2017-10-26 10:50 +0200
    Re: HTTPS enabled Debian Security repository Christoph Biedl <debian.axhn@manchmal.in-ulm.de> - 2017-10-26 20:30 +0200
      Re: HTTPS enabled Debian Security repository Hans-Christoph Steiner <hans@at.or.at> - 2017-10-27 12:50 +0200
        Re: HTTPS enabled Debian Security repository Morris Taylor <morris@eml.cc> - 2017-10-27 16:00 +0200
          Re: HTTPS enabled Debian Security repository Luca Filipozzi <lfilipoz@debian.org> - 2017-10-27 16:30 +0200
        Re: HTTPS enabled Debian Security repository Henrique de Moraes Holschuh <hmh@debian.org> - 2017-10-28 05:00 +0200
          Re: HTTPS enabled Debian Security repository Ansgar Burchardt <ansgar@debian.org> - 2017-10-28 10:30 +0200
            Re: HTTPS enabled Debian Security repository Hans-Christoph Steiner <hans@at.or.at> - 2017-10-30 10:10 +0100
              Re: HTTPS enabled Debian Security repository Russell Coker <russell@coker.com.au> - 2017-10-30 12:40 +0100
                Re: HTTPS enabled Debian Security repository Rob van der Putten <rob@sput.nl> - 2017-10-31 00:40 +0100
      Re: HTTPS enabled Debian Security repository Marek Sebera <marek.sebera@gmail.com> - 2017-11-09 11:00 +0100
        Re: HTTPS enabled Debian Security repository Paul Wise <pabs@debian.org> - 2017-11-09 11:20 +0100
          Re: HTTPS enabled Debian Security repository Marek Sebera <marek.sebera@gmail.com> - 2017-11-09 11:40 +0100
            Re: HTTPS enabled Debian Security repository Paul Wise <pabs@debian.org> - 2017-11-09 12:00 +0100
  Re: HTTPS enabled Debian Security repository Paul Wise <pabs@debian.org> - 2017-10-26 11:00 +0200
  Re: HTTPS enabled Debian Security repository Tototechy <angelmarckus@rediffmail.com> - 2020-01-16 17:00 +0100

csiph-web