8 ms·

Yeah just like Mint one of the most popular Linux distro where you had a preinstalled malmware on your ISO because servers got hacked. Should I mention the ultr

Yeah just like Mint one of the most popular Linux distro where you had a preinstalled malmware on your ISO because servers got hacked. Should I mention the ultra critical vulnerability of apt that was discovered few months ago or that apt doesn't use https, cuase it designed to work with http only in the first place.

dvdgsng 7y ago
Wait, designed to work with http only? Link?
- craftoman 7y ago
  That was the main reason why it got pawned few months ago. All main sources are using HTTP, it comes as default. It's your responsibility to make it https. Most of the distros are using HTTP by default except a few that respect privacy and security. https://www.theregister.co.uk/2019/01/22/debian_package_manager_flaws/ https://www.theregister.co.uk/2019/01/22/debian_package_mana... https://whydoesaptnotusehttps.com https://whydoesaptnotusehttps.com
- onei 7y ago
  I think "http only" is a bit misleading given [1], but I'm no expert. In essence, apt doesn't use HTTPS because it provides limited value for a package manager. However see the link for a more comprehensive explanation. [1] https://whydoesaptnotusehttps.com https://whydoesaptnotusehttps.com
  - craftoman 7y ago
    Apt create 20 years ago, it's using HTTP protocol almost everywhere even today. They should have redesigned the whole project and ban the HTTP completely IMHO. I'm using HTTPS even on localhost services when I have for example a project that needs Grafana and influxDB.
    - gnfurlong 7y ago
      I'll admit to being ignorant of apt as my primary distributions aren't debian based, but aren't packages cryptographically signed? If package signatures are validated after download, then it shouldn't matter right? Edit: Skimming and I shamefully didn't the read grandparent post. The link addresses exactly this point.
    - cyphar 7y ago
      The cryptography that apt (and other major distro package managers) use is much more safe and useful than TLS. Even if they switched to TLS on all transports, all of the package signing would still be absolutely required in order for package upgrades to be safe. In addition, the package manger should distrust the transport no matter what (in fact, it should be resilient to compromised repo servers). Now, should apt use TLS by default? Ideally, yes. A secure transport is better than an insecure one regardless of what you're sending through it. But unfortunately it's not as simple as that. Most CDNs charge extra for TLS, and many existing free mirrors of packages don't provide TLS at all. Also, using HTTP allows for proxies to cache packages. Unfortunately, as we discovered recently, apt had not been distrustful enough of HTTP metadata (which was a pretty big mistake since the entire design of package managers is that they must distrust the transport, especially if it's completely insecure like HTTP).
  - tomc1985 7y ago
    You don't need HTTPS if everything is signed appropriately
AsyncAwait 7y ago
Not sure about apt, but this is solvable. Arch's pacman supports https and package signing and only packages signed by trusted maintainers will get installed. That means it should be fairly difficult to swap legit packages for malicious ones and them getting installed. Not impossible, nothing ever is, but fairly difficult.
- tomc1985 7y ago
  APT does https and multiple flavors of signing, the repo maintainer just has to use it
tomc1985 7y ago
That's why I said most

dvdgsng 7y ago

Wait, designed to work with http only? Link?

craftoman 7y ago
That was the main reason why it got pawned few months ago. All main sources are using HTTP, it comes as default. It's your responsibility to make it https. Most of the distros are using HTTP by default except a few that respect privacy and security. https://www.theregister.co.uk/2019/01/22/debian_package_manager_flaws/ https://www.theregister.co.uk/2019/01/22/debian_package_mana... https://whydoesaptnotusehttps.com https://whydoesaptnotusehttps.com
onei 7y ago
I think "http only" is a bit misleading given [1], but I'm no expert. In essence, apt doesn't use HTTPS because it provides limited value for a package manager. However see the link for a more comprehensive explanation. [1] https://whydoesaptnotusehttps.com https://whydoesaptnotusehttps.com
- craftoman 7y ago
  Apt create 20 years ago, it's using HTTP protocol almost everywhere even today. They should have redesigned the whole project and ban the HTTP completely IMHO. I'm using HTTPS even on localhost services when I have for example a project that needs Grafana and influxDB.
  - gnfurlong 7y ago
    I'll admit to being ignorant of apt as my primary distributions aren't debian based, but aren't packages cryptographically signed? If package signatures are validated after download, then it shouldn't matter right? Edit: Skimming and I shamefully didn't the read grandparent post. The link addresses exactly this point.
  - cyphar 7y ago
    The cryptography that apt (and other major distro package managers) use is much more safe and useful than TLS. Even if they switched to TLS on all transports, all of the package signing would still be absolutely required in order for package upgrades to be safe. In addition, the package manger should distrust the transport no matter what (in fact, it should be resilient to compromised repo servers). Now, should apt use TLS by default? Ideally, yes. A secure transport is better than an insecure one regardless of what you're sending through it. But unfortunately it's not as simple as that. Most CDNs charge extra for TLS, and many existing free mirrors of packages don't provide TLS at all. Also, using HTTP allows for proxies to cache packages. Unfortunately, as we discovered recently, apt had not been distrustful enough of HTTP metadata (which was a pretty big mistake since the entire design of package managers is that they must distrust the transport, especially if it's completely insecure like HTTP).
- tomc1985 7y ago
  You don't need HTTPS if everything is signed appropriately

AsyncAwait 7y ago

Not sure about apt, but this is solvable. Arch's pacman supports https and package signing and only packages signed by trusted maintainers will get installed. That means it should be fairly difficult to swap legit packages for malicious ones and them getting installed. Not impossible, nothing ever is, but fairly difficult.

tomc1985 7y ago
APT does https and multiple flavors of signing, the repo maintainer just has to use it

tomc1985 7y ago

That's why I said most