6 ms·

Using HTTP for apt may seem bad, but you should really pay attention to Ubuntu itself: https://github.com/canonical-websites/www.ubuntu.com/issues/4394 https://

• nyolfen 8y ago
  use torrents
  • Sephr 8y ago
    The official torrent links are also distributed over insecure HTTP and are also trivially easy to MitM attack.
    • btown 8y ago
      That's ridiculous. https://www.ubuntu.com/download/alternative-downloads https://www.ubuntu.com/download/alternative-downloads There is no technical excuse for a torrent file to be distributed over HTTP.
    • nneonneo 8y ago
      Ugh couldn’t they just put magnet links on their nice HTTPS site? It sounds like they just really don’t want to have to update their site when new releases come out.
      • groestl 8y ago
        Or... we just found the governmentally sanctioned attack vector?
      • web007 8y ago
        Per the current image / torrent: magnet:?xt=urn:btih:a4104a9d2f5615601c429fe8bab8177c47c05c84&dn=ubuntu-18.04.1.0-live-server-amd64.iso
• vvanders 8y ago
  Wow, that's pretty stunning and I'm honestly quite shocked it's still the case in '19. Just downloaded Ubuntu server for some local instances here at home and realized that I hit this path without even knowning. [edit] Looks like ISO signatures are served over HTTP as well.
  • blub 8y ago
    It's one of my pet peeves and I can say that a ton of organisations do this in 2019, including ones that should know better, like Ubuntu. The only secure way to install is to somehow get their key, already have gpg installed and then verify that way.
    • whydoyoucare 8y ago
      As long as verification happens independently, and the keys are obtained from trusted sources, there is nothing wrong in downloading Ubuntu over http. It appears this to be the case, see "How to verify Ubuntu download" tutorial that provides detailed steps: https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu#0 https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify... (If you plan to install an Operating System, then I believe some homework is in order -- you cannot expect the OS developers to spoon-feed you trivial security aspects that are expected to be a skill-set that you, the operating system installer, or System Administrator, do possess).
      • vvanders 8y ago
        > and the keys are obtained from trusted sources Isn't that a little hard if the verification keys(from that link) are served over HTTP[1][2]? [1] http://releases.ubuntu.com/18.04/SHA256SUMS.gpg http://releases.ubuntu.com/18.04/SHA256SUMS.gpg [2] http://releases.ubuntu.com/?_ga=2.21478331.1690774166.1548124147-631293260.1548124147 http://releases.ubuntu.com/?_ga=2.21478331.1690774166.154812...
        • whydoyoucare 8y ago
          The Ubuntu verification tutorial (see my previous post) points to keyserver.ubuntu.com.
• dessant 8y ago
  I usually download it from the kernel.org mirror for this reason. https://mirrors.kernel.org/ubuntu-releases/18.10/ https://mirrors.kernel.org/ubuntu-releases/18.10/
  • whydoyoucare 8y ago
    How do you know they obtain it from a trusted source? ;-)
    • dessant 8y ago
      I assume that they check the signatures using keys that they've exchanged in person by booping noses.
      • bigiain 8y ago
        You're happy to just assume someone else checks the .sig? Why don't you do it yourself?
        • dessant 8y ago
          I also do it myself. Boop
• gymshoes 8y ago
  Linux Mint was breached some time ago: https://blog.linuxmint.com/?p=2994 https://blog.linuxmint.com/?p=2994