4 ms·
It's scary how most people in that thread seem to be more concerned about forcing an installation, rather than pause and consider why the hashes might be wrong
by 0x0 10y ago
It's scary how most people in that thread seem to be more concerned about forcing an installation, rather than pause and consider why the hashes might be wrong and why it might not be a good idea to install debs with incorrect hashes.
If the apt repo was compromised (but the signing keys were not), this is very likely exactly the symptom that would appear.
- cjbprime 10y ago> If the apt repo was compromised (but the signing keys were not), this is very likely exactly the symptom that would appear. I don't think that's correct. It would pass a checksum test and fail a signature test with a "W: GPG Error". The checksum test is not about cryptographic security, it's just about files referenced by the Packages file having the same hash that the Packages file declares them to have. You don't need any signing keys to make that happen.
- 0x0 10y agoWhat's more suspicious: Bad hashes or bad signatures? What would an attacker choose if their goal was to get as many people as possible to force install?
- cjbprime 10y agoIt's impossible to force install the packages when they have bad hashes (hence the severe breakage here), and it is possible to install the packages when they have bad signatures if you didn't import the gpg key or don't run with signature checking. So I'd guess a rational attacker would choose a bad signature. But attackers can be irrational; it doesn't prove it's not an attack. Just not my intuition.