4 ms·

I still have to trust some random guy, SSL or not. Let me put this in simpler terms. With PGP, I have to trust: - The package maintainer (aka random guy with a

I still have to trust some random guy, SSL or not. Let me put this in simpler terms. With PGP, I have to trust: - The package maintainer (aka random guy with a laptop, aka ncopa) - ncopa's government With SSL, I have to trust: - The package maintainer - ncopa's government - My government - The governments of anyone along the link - Certificate authorities - The governments of every trusted certificate authority - A workplace's mandatory root certificate which MITMs all browser traffic - etc Which of these lists has fewer threats? SSL is generally more secure than the alternative, but it doesn't add security on top of a PGP-signed package repository.

comex 8y ago
It's not a question of SSL versus PGP. It's a question of PGP + SSL versus PGP alone. SSL provides: - Privacy, i.e. making it harder to learn what packages you are installing, or any data about your system that can be gathered from request headers. (Traffic analysis is still possible, but much more difficult and won't disclose request headers.) - An extra layer of defense if there are flaws in the system doing PGP verification, as in this instance (or perhaps in the HTTP protocol implementation itself). Of course, the most important thing is to fix that system, and IMO apk should continue to be regarded as insecure as long as it continues to unpack files onto the root FS before doing any verification; there are just too many ways to screw that up. Still, in practice, adding SSL would have made it much more difficult for an attacker to get to a position where they could exploit the vulnerability. Both of the benefits above are relatively minor. But in a world where SSL is now the expected default for the vast majority of things served over HTTP, the cost of adding SSL to one more thing should be seen as extremely minor, making it easily justified.
- Sir_Cmpwn 8y ago
  These are both very good points, though I want to point out that the first doesn't lead to RCE, which is a much more severe problem that information disclosure. I think Alpine should add SSL, but my message is that I don't think that the problem on display here is result of a flaw in the current design.
tialaramex 8y ago
What you're doing here is a technique called the Gish Gallop - in which rather than engage with debate you just try to introduce more and more "reasons" you're right, most of them entirely spurious, hoping to somehow win on the numbers. That is not an honest way to have a conversation. Knock it off.
- Sir_Cmpwn 8y ago
  I'm doing no such thing. I have issued rebuttals and new arguments, not just new arguments and a tactical ignoring of the counterarguments. If you can't address my points then don't. Don't acuse me of arguing in bad faith. You can knock that off, thank you very much.
  - tialaramex 8y ago
    Thing you didn't provide: 1. Any citation whatsoever for your claim that "Certificate authorities are regularly compromised" 2. Any citation whatsoever for your claim that "PGP keys are much more secure" 3. The list of those maintainers and their countries you're actually trusting for some reason with your current stance even though you're supposedly worried about "sketchy countries". Yes, a list, I know, you don't have one. Which is illustrative that in fact this "sketchy countries" concern was pure invention and you don't actually care. 4. The measures Alpine puts in place to protect these keys. Again in reality there aren't any, and in reality you don't care, because your concerns are bullshit. In the technical sense. 5. The public forum where I, as a third party, can see that this is all above board and not, as is the reality, just nobody cares and it's all assumed to be fine. For reference for the Web PKI this forum is operated by Mozilla, mozilla.dev.security.policy Things you did provide: 1. A big list of non-threats like on-path governments somehow tampering with HTTPS. That's a Gish Gallop. You don't engage with the existing debate, you just keep spewing more "new arguments" of no value, in the hope people will accept you're right.
    - Sir_Cmpwn 8y ago
      I can't provide what I'm not asked for. 1, 2: I didn't cite explanations for these because I explained them directly. 3: https://git.alpinelinux.org/cgit/aports/tree/main/alpine-keys?h=master https://git.alpinelinux.org/cgit/aports/tree/main/alpine-key... 4: I don't know the particular steps ncopa et al take to safeguard their private keys, but that doesn't mean that my concerns are technical bullshit. 5: You're looking for alpine-devel, a public mailing list. I'm not going to entertain further discussion with you if you aren't going to be civil. Ask questions and I will ask them. Acuse me of bad faith and call my concerns bullshit and I won't.

comex 8y ago

It's not a question of SSL versus PGP. It's a question of PGP + SSL versus PGP alone. SSL provides: - Privacy, i.e. making it harder to learn what packages you are installing, or any data about your system that can be gathered from request headers. (Traffic analysis is still possible, but much more difficult and won't disclose request headers.) - An extra layer of defense if there are flaws in the system doing PGP verification, as in this instance (or perhaps in the HTTP protocol implementation itself). Of course, the most important thing is to fix that system, and IMO apk should continue to be regarded as insecure as long as it continues to unpack files onto the root FS before doing any verification; there are just too many ways to screw that up. Still, in practice, adding SSL would have made it much more difficult for an attacker to get to a position where they could exploit the vulnerability. Both of the benefits above are relatively minor. But in a world where SSL is now the expected default for the vast majority of things served over HTTP, the cost of adding SSL to one more thing should be seen as extremely minor, making it easily justified.

Sir_Cmpwn 8y ago
These are both very good points, though I want to point out that the first doesn't lead to RCE, which is a much more severe problem that information disclosure. I think Alpine should add SSL, but my message is that I don't think that the problem on display here is result of a flaw in the current design.

tialaramex 8y ago

What you're doing here is a technique called the Gish Gallop - in which rather than engage with debate you just try to introduce more and more "reasons" you're right, most of them entirely spurious, hoping to somehow win on the numbers. That is not an honest way to have a conversation. Knock it off.

Sir_Cmpwn 8y ago
I'm doing no such thing. I have issued rebuttals and new arguments, not just new arguments and a tactical ignoring of the counterarguments. If you can't address my points then don't. Don't acuse me of arguing in bad faith. You can knock that off, thank you very much.
- tialaramex 8y ago
  Thing you didn't provide: 1. Any citation whatsoever for your claim that "Certificate authorities are regularly compromised" 2. Any citation whatsoever for your claim that "PGP keys are much more secure" 3. The list of those maintainers and their countries you're actually trusting for some reason with your current stance even though you're supposedly worried about "sketchy countries". Yes, a list, I know, you don't have one. Which is illustrative that in fact this "sketchy countries" concern was pure invention and you don't actually care. 4. The measures Alpine puts in place to protect these keys. Again in reality there aren't any, and in reality you don't care, because your concerns are bullshit. In the technical sense. 5. The public forum where I, as a third party, can see that this is all above board and not, as is the reality, just nobody cares and it's all assumed to be fine. For reference for the Web PKI this forum is operated by Mozilla, mozilla.dev.security.policy Things you did provide: 1. A big list of non-threats like on-path governments somehow tampering with HTTPS. That's a Gish Gallop. You don't engage with the existing debate, you just keep spewing more "new arguments" of no value, in the hope people will accept you're right.
  - Sir_Cmpwn 8y ago
    I can't provide what I'm not asked for. 1, 2: I didn't cite explanations for these because I explained them directly. 3: https://git.alpinelinux.org/cgit/aports/tree/main/alpine-keys?h=master https://git.alpinelinux.org/cgit/aports/tree/main/alpine-key... 4: I don't know the particular steps ncopa et al take to safeguard their private keys, but that doesn't mean that my concerns are technical bullshit. 5: You're looking for alpine-devel, a public mailing list. I'm not going to entertain further discussion with you if you aren't going to be civil. Ask questions and I will ask them. Acuse me of bad faith and call my concerns bullshit and I won't.