5 ms·

I don't like certificate authorities either but "easily compromised", especially in this context, is just disingenuous. HTTPS would be a meaningful security im

I don't like certificate authorities either but "easily compromised", especially in this context, is just disingenuous. HTTPS would be a meaningful security improvement to this system.

Sir_Cmpwn 8y ago
It's not. Certificate authorities are regularly compromised by invasive workplaces, sketchy governments, and crappy CAs. PGP keys are much more secure. HTTPS would not be a meaningful security improvement, not accounting for justicz's comment. At best, it would be the same amount of security, but more annoying to maintain.
- JoshTriplett 8y ago
  > Certificate authorities are regularly compromised by invasive workplaces, sketchy governments, and crappy CAs. They can't do that silently anymore, though, not without getting caught. Certificate Transparency addresses that.
- tialaramex 8y ago
  > It's not. Certificate authorities are regularly compromised by invasive workplaces, sketchy governments, and crappy CAs. PGP keys are much more secure. Citation very much needed for this claim that (publicly trusted) Certificate Authorities are "regularly compromised" while some random guy's PGP keys on his laptop are "much more secure". You claim to be worried about "sketchy governments" so here's a nice simple exercise. List the maintainers of the top say, 100 Alpine packages and for each the countries of which they are citizens and their country of residence. Someone worried about "sketchy governments" would definitely know all this of course, since it's _far_ easier for a "sketchy government" to lean on one individual. Next I'd like to know what Alpine is doing to ensure all those PGP keys are kept safe and that, for example, nobody's PGP key for signing Alpine packages is on, say, an unencrypted backup they took back in 2017... If one of the CAs in the Web PKI does something they shouldn't there's a public forum for discussing how it happened, what's being done about it, how it will be prevented from happening again, and so on. Where can I find the public forum where Alpine maintainers have to confess to anything that goes wrong?
  - Sir_Cmpwn 8y ago
    I still have to trust some random guy, SSL or not. Let me put this in simpler terms. With PGP, I have to trust: - The package maintainer (aka random guy with a laptop, aka ncopa) - ncopa's government With SSL, I have to trust: - The package maintainer - ncopa's government - My government - The governments of anyone along the link - Certificate authorities - The governments of every trusted certificate authority - A workplace's mandatory root certificate which MITMs all browser traffic - etc Which of these lists has fewer threats? SSL is generally more secure than the alternative, but it doesn't add security on top of a PGP-signed package repository.
    - comex 8y ago
      It's not a question of SSL versus PGP. It's a question of PGP + SSL versus PGP alone. SSL provides: - Privacy, i.e. making it harder to learn what packages you are installing, or any data about your system that can be gathered from request headers. (Traffic analysis is still possible, but much more difficult and won't disclose request headers.) - An extra layer of defense if there are flaws in the system doing PGP verification, as in this instance (or perhaps in the HTTP protocol implementation itself). Of course, the most important thing is to fix that system, and IMO apk should continue to be regarded as insecure as long as it continues to unpack files onto the root FS before doing any verification; there are just too many ways to screw that up. Still, in practice, adding SSL would have made it much more difficult for an attacker to get to a position where they could exploit the vulnerability. Both of the benefits above are relatively minor. But in a world where SSL is now the expected default for the vast majority of things served over HTTP, the cost of adding SSL to one more thing should be seen as extremely minor, making it easily justified.
      - Sir_Cmpwn 8y ago
        These are both very good points, though I want to point out that the first doesn't lead to RCE, which is a much more severe problem that information disclosure. I think Alpine should add SSL, but my message is that I don't think that the problem on display here is result of a flaw in the current design.

I don't like certificate authorities either but "easily compromised", especially in this context, is just disingenuous. HTTPS would be a meaningful security improvement to this system.

Sir_Cmpwn 8y ago

It's not. Certificate authorities are regularly compromised by invasive workplaces, sketchy governments, and crappy CAs. PGP keys are much more secure. HTTPS would not be a meaningful security improvement, not accounting for justicz's comment. At best, it would be the same amount of security, but more annoying to maintain.

JoshTriplett 8y ago
> Certificate authorities are regularly compromised by invasive workplaces, sketchy governments, and crappy CAs. They can't do that silently anymore, though, not without getting caught. Certificate Transparency addresses that.
tialaramex 8y ago
> It's not. Certificate authorities are regularly compromised by invasive workplaces, sketchy governments, and crappy CAs. PGP keys are much more secure. Citation very much needed for this claim that (publicly trusted) Certificate Authorities are "regularly compromised" while some random guy's PGP keys on his laptop are "much more secure". You claim to be worried about "sketchy governments" so here's a nice simple exercise. List the maintainers of the top say, 100 Alpine packages and for each the countries of which they are citizens and their country of residence. Someone worried about "sketchy governments" would definitely know all this of course, since it's _far_ easier for a "sketchy government" to lean on one individual. Next I'd like to know what Alpine is doing to ensure all those PGP keys are kept safe and that, for example, nobody's PGP key for signing Alpine packages is on, say, an unencrypted backup they took back in 2017... If one of the CAs in the Web PKI does something they shouldn't there's a public forum for discussing how it happened, what's being done about it, how it will be prevented from happening again, and so on. Where can I find the public forum where Alpine maintainers have to confess to anything that goes wrong?
- Sir_Cmpwn 8y ago
  I still have to trust some random guy, SSL or not. Let me put this in simpler terms. With PGP, I have to trust: - The package maintainer (aka random guy with a laptop, aka ncopa) - ncopa's government With SSL, I have to trust: - The package maintainer - ncopa's government - My government - The governments of anyone along the link - Certificate authorities - The governments of every trusted certificate authority - A workplace's mandatory root certificate which MITMs all browser traffic - etc Which of these lists has fewer threats? SSL is generally more secure than the alternative, but it doesn't add security on top of a PGP-signed package repository.
  - comex 8y ago
    It's not a question of SSL versus PGP. It's a question of PGP + SSL versus PGP alone. SSL provides: - Privacy, i.e. making it harder to learn what packages you are installing, or any data about your system that can be gathered from request headers. (Traffic analysis is still possible, but much more difficult and won't disclose request headers.) - An extra layer of defense if there are flaws in the system doing PGP verification, as in this instance (or perhaps in the HTTP protocol implementation itself). Of course, the most important thing is to fix that system, and IMO apk should continue to be regarded as insecure as long as it continues to unpack files onto the root FS before doing any verification; there are just too many ways to screw that up. Still, in practice, adding SSL would have made it much more difficult for an attacker to get to a position where they could exploit the vulnerability. Both of the benefits above are relatively minor. But in a world where SSL is now the expected default for the vast majority of things served over HTTP, the cost of adding SSL to one more thing should be seen as extremely minor, making it easily justified.
    - Sir_Cmpwn 8y ago
      These are both very good points, though I want to point out that the first doesn't lead to RCE, which is a much more severe problem that information disclosure. I think Alpine should add SSL, but my message is that I don't think that the problem on display here is result of a flaw in the current design.