4 ms·
"The CentOS managed base image uses `yum` and `rpm` for package management, and these pull RPM files only over HTTPS connections." That's interesting. Is there
by rob-olmos 8y ago
"The CentOS managed base image uses `yum` and `rpm` for package management, and these pull RPM files only over HTTPS connections."
That's interesting. Is there a reason for that?
IIRC the stock CentOS doesn't use HTTPS for its yum/rpm repos and I figured it wasn't necessary to use HTTPS since the package signature is verified.
- blaike 8y agoSome orgs have requirements for using encryption in transit for everything.
- TurningCanadian 8y agoa MITM can trick your server into thinking there are no updates, and no error will be raised
- skj 8y agoThat, and an attacker could do a replay attack, and potentially send you to an earlier (vulnerable) version.