3 ms·
>To mitigate this problem, APT archives includes a timestamp after which all the files are considered stale How often is this, practically? If I'm understandin
by dooglius 8y ago
>To mitigate this problem, APT archives includes a timestamp after which all the files are considered stale
How often is this, practically? If I'm understanding this right, each new timestamp would come only with a package upgrade, meaning the time period is quite a long time indeed, long enough for a replay attack to work. I would argue that there should be a mechanism requiring a signed the-latest-package-is-X message updated at least every day or so.
Edit: it looks like this is actually what's going on. The page wasn't clear, but it is a metadata "Releases" file that is timestamped, not the packages themselves.
- jkaplowitz 8y agoThe security repository generally serves up a field in its metadata saying that the data shouldn't be trusted for more than 7 days, if it hasn't changed since 2014 when I encountered this duration as part of my day-job work. It's safe to assume the trusted duration hasn't increased, at least.
- dooglius 8y agohttp://security-cdn.debian.org/dists/stable/updates/Release http://security-cdn.debian.org/dists/stable/updates/Release is 10 days in the future. I still think it should be shorter, as it's pretty conceivable to exploit a 1-day vulnerability in that timeframe, but it's not that bad.