5 ms·

> I'll tell you what: instead of "don't use PGP," how about "Don't use SHA-1 and don't use any tool that accepts SHA-1 by default." OK - lets see the implicati

> I'll tell you what: instead of "don't use PGP," how about "Don't use SHA-1 and don't use any tool that accepts SHA-1 by default." OK - lets see the implications of this: > Today, in 2020, that means "don't use ... Debian. (As far as I can tell, the known SHA1 attacks have no practical impact on the security of using PGP to sign software updates, where the key management isn't reliant on web of trust... )

dfabulich 6y ago
In practice, Debian downloads your packages over HTTPS from reliable trusted parties. HTTPS is the real, actual defense against package manipulation. The PGP signatures do nothing, but they don't really need to work; that's why nobody's bothered to fix them.
- anderskaseorg 6y ago
  No, a default Debian installation downloads packages over plain HTTP. It doesn’t even support downloading packages over HTTPS unless you install the optional apt-transport-https package and edit your sources.list. It uses SHA-2 checksums since Debian 9, though.
- pabs3 6y ago
  https cannot protect you from malicious apt mirrors or CDN node operators.