3 ms·
What could https possibly defend against here? Packages and other software needs to be secure at rest, not in transit. That much was learnt in the 90s. Nobody i
by xorcist 10y ago
What could https possibly defend against here? Packages and other software needs to be secure at rest, not in transit. That much was learnt in the 90s. Nobody is going to target you with a mitm attack to inject a false image. Mirrors are the weakest link.
There are mentions of signatures but that these are "too hard". I looked at the Debian cdimage download and I end up in a directory with iso images and gpg signatures, so they're hardly invisible. There should be better instructions how to actually verify them, but inconstructive rants accomplish nothing.
- JonathonW 10y agoYep, nobody's going to target you with an MITM attack to inject a false image: http://www.symantec.com/connect/blogs/w32flamer-microsoft-windows-update-man-middle http://www.symantec.com/connect/blogs/w32flamer-microsoft-wi...
- xorcist 10y agoA good example. Malware that uses wpad acts on unencrypted traffic. Transport security such as https does not protect against this type of attacks.
- nitrogen 10y agoTransit encryption provides privacy as well as a minimal level of authentication.
- clarry 10y agoBut the watchmen can still see you connect to the IP address of yourfavoritelinux.org or its mirror. And then they can see you transfer approximately a distro image sized chunk of data. Perhaps you just downloaded your favorite linux distro? I argue that the privacy provided is minimal, and for real privacy, you'll have to find something like tor (not an endorsement of it) or alternative, anonymous channels... As for authentication, yes, it is quite minimal. So HTTPS doesn't solve any problem well (meanwhile introducing some of its own problems). The better solutions to these problems make HTTPS wholly unnecessary. I find the fixation on HTTPS bizarre, even concerning. Would the author have written this piece if all distros ticked all the three HTTPS boxes? Would he then no longer consider the state of things sad? That would be dangerous. That would be alarming. I hate the "false sense of security" argument that people apply to just about anything these days.. but this would be it.
- nitrogen 10y agoI find the anti-HTTPS fixation equally bizarre. There are lots of approximately image-sized files one might download, so simply knowing that "IP X transferred 700MB of data from IP Y" is not the same as knowing that "IP X downloaded CentOS from IP Y, therefore target IP X with CentOS-specific attacks".
- xorcist 10y ago> I find the anti-HTTPS fixation equally bizarre Nobody is anti-https here. The point is that it does doesn't protect against software distribution integrity (especially not when mirrors and CDNs are used). Pretending that security would improve with https risks making the problem worse, not better. What's needed is better instructions how to verify integrity included with the installation instructions.
- Aaron1011 10y agoWhat problems does HTTPS introduce (besides a potential for a false sense of security)? "Better solutions" (excluding the anonymity aspect) such as GPG signatures still require that you trust the key fingerprint used to sign the hash. That's not necessarily any more trustworthy than an HTTPS certificate, especially for someone who hasn't downloaded the ISO before. "Would the author have written this piece if all distros ticked all the three HTTPS boxes?" Most likely, as three of the criteria listed have nothing to do with HTTPS ("Checksum available", "GPG signature available", and "Verification instructions clear and easy to find").