4 ms·
Or they could serve all this over HTTPS where that process would happen automatically when you download. As another poster noted the keyserver in that link wil
by vvanders 8y ago
Or they could serve all this over HTTPS where that process would happen automatically when you download.
As another poster noted the keyserver in that link will work over http so you're still susceptible to a possible downgrade attack.
Given how easy it is to get a LE cert these days it's making me question what other security decision Ubuntu is making that I'm not aware of or have the expertise to evaluate.
- bigiain 8y agoHeh. I think that "other poster" may also have been me... With regards to LE certs, I discussed elsewhere here the problems faced by the apt developers that make the obvious "just install a LE cert!" answer not actually workable for them - they rely heavily of volunteer run mirrors and local proxies. I don't know what Ubuntu's ISO download "server" really is underneath, it's possible they've got similar problems, where either they pay for all the bandwidth themselves, or they let people assume that an ssl secured connection to "ubuntu-mirror.usyd.edu.au" or "ubuntu-mirror.evilhacker.ru" is for some reason "safer" than an http connection...