4 ms·
The Ubuntu verification tutorial (see my previous post) points to keyserver.ubuntu.com.
by whydoyoucare 8y ago
The Ubuntu verification tutorial (see my previous post) points to keyserver.ubuntu.com.
- bigiain 8y agoHmmm, I just had a look there. keyserver.ubuntu.com is available over http as well as https, which means it's probably susceptible to a downgrade attack if you're mitming it - which would let you serve a bogus public key and therefore generate apparently valid signatures for the hash for a modified ISO. That's not good...
- cordonbleu 8y agoits happened in variant form already, this is why habits of complacency should be kept in check. remember this ? V https://www.theregister.co.uk/2016/02/21/linux_mint_hacked_malwareinfected_isos_linked_from_official_site/ https://www.theregister.co.uk/2016/02/21/linux_mint_hacked_m...