3 ms·
I think debian does package updates over HTTP in the clear. It's not necessarily a problem if the package is signed and the signature is verified.
by pydry 4y ago
I think debian does package updates over HTTP in the clear. It's not necessarily a problem if the package is signed and the signature is verified.
- tialaramex 4y agoBut you don't have privacy. If you didn't want anybody to know that you've got clown-fetish-program version 1.6.4 installed, then Debian's package upgrade code fetching clown-fetish-program version 1.6.4.1 update is a disappointing give away. In the real world is it embarrassing to have Emacs installed? Or KDE? Or even Tux Racer ? Probably not. But all things being equal we'd rather the program just kept this to itself right?
- Avamander 4y agoIt could also reveal information about your system that could be used for exploiting. E.g. you have a package installed that can be used for privilege escalation once compromised. Not to mention the additional possibility of exploiting apt itself vs. having to exploit the TLS stack (which goes trough a lot more scrutiny).
- teddyh 4y agohttps://tracker.debian.org/pkg/anarchism https://tracker.debian.org/pkg/anarchism