3 ms·

What's more suspicious: Bad hashes or bad signatures? What would an attacker choose if their goal was to get as many people as possible to force install?

• cjbprime 10y ago
  It's impossible to force install the packages when they have bad hashes (hence the severe breakage here), and it is possible to install the packages when they have bad signatures if you didn't import the gpg key or don't run with signature checking. So I'd guess a rational attacker would choose a bad signature. But attackers can be irrational; it doesn't prove it's not an attack. Just not my intuition.
  • 0x0 10y ago
    That's interesting, I'm assuming you're talking about apt now. I don't think dpkg checks signatures if you install straight from a .deb. :)
    • jwilk 10y ago
      It doesn't, mostly because there are no signatures in a deb. :)