4 ms·
So will someone more in the know than myself tell me if using apt-transport-https is a reasonable solution to this problem, or, at least mitigates the problem?
by systematical 8y ago
So will someone more in the know than myself tell me if using apt-transport-https is a reasonable solution to this problem, or, at least mitigates the problem?
As someone who uses Linux as their personal O.S. and administers some at work, but doesn't think in bash, I'd really like an answer :-)
- kelnos 8y agoIt will mitigate the possibility of someone MitM'ing your connection to the package mirror. It won't protect you against a malicious package mirror.
- moosingin3space 8y agoIt makes it so that your mirror would have to be exploiting apt, instead of effectively anyone. As a result, using TLS for downloads would mitigate this (but not fix it). I've read the arguments against HTTPS for apt many times. They're wrong.