3 ms·
I think the concern is more about man-in-the-middle attacks. Even then, though, doesn't apt verify the hashes of downloaded packages?
by cosmojg 6y ago
I think the concern is more about man-in-the-middle attacks. Even then, though, doesn't apt verify the hashes of downloaded packages?
- nine_k 6y agoHow does apt get said hashes? That's the key problem.
- goodpoint 6y agoBy checking a signature from a trusted key. MitM is handled.
- alfiedotwtf 6y agoHow do you trust distribution if you also have mirrors all across the globe (that are not Cononical's machines)?
- cosmojg 6y agoSignatures generated with trusted keys.