3 ms·

> Of course, since these packages are built automatically without human supervision it’s likely that some of them will have bugs in them that would otherwise ha

> Of course, since these packages are built automatically without human supervision it’s likely that some of them will have bugs in them that would otherwise have been caught by the maintainer. Human supervision isn't enough to protect the supply chain, and I can't think of a time that it's actually stopped an attack at the packaging stage, but having some extra "friction" in the process seems like it should be a benefit. Ideally an attacker would have to get past both the upstream author and the Debian maintainer, rather than these being two separate single points of failure. Fortunately the Debian project is improving the situation with regards to supply chain attacks by continuing to work on Reproducible Builds. I think the next step from there needs to be Binary Transparency, with the adoption of the sort of approach being trialled by Arch Linux: https://github.com/kpcyrd/pacman-bintrans https://github.com/kpcyrd/pacman-bintrans

arminiusreturns 5y ago
Oh cool, I didn't know about this. It's always been something I've been concerned about, but wasn't sure how to address. I like their summary: Cryptographic signatures prove that a message originates from somebody with control over the private key, but it's impossible to prove that the private key didn't sign additional messages. In update security this means a signed update is a strong indicator the update is authentic, but you can't be sure this update is the same update everybody else got. Somebody in control of the update key could craft a malicious update, sign it and feed it specifically to you.
- stragies 5y ago
  To alleviate that concern a bit, Debian apt can be configured to fetch updates via TOR, so that it becomes (more) difficult to send YOU -specifically- a doctored update.
pabs3 5y ago
Bootstrappable Builds are another related important effort: https://bootstrappable.org/ https://bootstrappable.org/

arminiusreturns 5y ago

Oh cool, I didn't know about this. It's always been something I've been concerned about, but wasn't sure how to address. I like their summary: Cryptographic signatures prove that a message originates from somebody with control over the private key, but it's impossible to prove that the private key didn't sign additional messages. In update security this means a signed update is a strong indicator the update is authentic, but you can't be sure this update is the same update everybody else got. Somebody in control of the update key could craft a malicious update, sign it and feed it specifically to you.

stragies 5y ago
To alleviate that concern a bit, Debian apt can be configured to fetch updates via TOR, so that it becomes (more) difficult to send YOU -specifically- a doctored update.

pabs3 5y ago

Bootstrappable Builds are another related important effort: https://bootstrappable.org/ https://bootstrappable.org/