3 ms·
The packages you download can be easily inferred even transmitted over tls. What does tls buy you? That's the argument at least. You could always download them
by dmm 6y ago
The packages you download can be easily inferred even transmitted over tls. What does tls buy you? That's the argument at least.
You could always download them over tor.
- cosmojg 6y agoI think the concern is more about man-in-the-middle attacks. Even then, though, doesn't apt verify the hashes of downloaded packages?
- nine_k 6y agoHow does apt get said hashes? That's the key problem.
- goodpoint 6y agoBy checking a signature from a trusted key. MitM is handled.
- alfiedotwtf 6y agoHow do you trust distribution if you also have mirrors all across the globe (that are not Cononical's machines)?
- cosmojg 6y agoSignatures generated with trusted keys.