4 ms·
Defense in depth is a thing. SSL provides some security guarantees. Using signed package databases also provide some security guarantees. Both may overlap in
by zaarn 8y ago
Defense in depth is a thing.
SSL provides some security guarantees.
Using signed package databases also provide some security guarantees.
Both may overlap in what security they provide.
BUT!
If one fails, the other can continue to provide a subset of the previously available guarantees.
- moviuro 8y agoNot in the case of OpenSSL, no. (Some) OpenSSL issues, just as (some) apt issues, end with RCE. Game over. Priv-sep, correctly handling untrusted files (e.g. 1. check signature, then 2. execute whatever; not the other way round), memory-safe languages, etc. would be more welcome additions.
- tracker1 8y agoAnd overcoming both is much harder than overcoming either on their own.
- moviuro 8y agoIn the worst case, you only need to overcome one. And you ~double your attack surface.
- tracker1 8y agoWhich one? If you gain control of a server, you'd still have to overcome signing... and you only control that single server, not all replicas (for a bug like in TFA). Could you describe a way to have double the attack surface that would effect the majority of peer servers?
- blattimwind 8y ago> Priv-sep Apt even has the had part already implemented by separating the network I/O in other processes. Only problem is that those currently write directly to system directories, but that can be fixed.