3 ms·
Not exactly true. If you as a malicious third person can MITM the http connection for updates, you can push an older signed package with known vulnerabilities.
by breakingcups 10y ago
Not exactly true. If you as a malicious third person can MITM the http connection for updates, you can push an older signed package with known vulnerabilities.
- jbk 10y agoOnly if the installer does not check/warn about downgrades.