3 ms·

Pretty ignorant. HTTP is alive and well. Most people don't realise a lot of software/OS updates come through HTTP so that HTTP caching servers have an opportun

Pretty ignorant. HTTP is alive and well. Most people don't realise a lot of software/OS updates come through HTTP so that HTTP caching servers have an opportunity to do their thing. But but... what abouts th3 securaitai? The updates are signed. Tamper with them all you like.

chrismorgan 3y ago
HTTPS is not just about tamper protection, but also about confidentiality. Do you want an attacker to be able to identify exactly which packages and which versions of packages you have installed? (Mind you, you’ll often be able to do a good job of guessing based on the side-channel leak of how much data is transferred.) See also: pervasive monitoring is an attack <https://www.rfc-editor.org/rfc/rfc7258.html https://www.rfc-editor.org/rfc/rfc7258.html>. I would expect all major operating systems to deliver their updates over HTTPS these days. (I know Arch Linux’s mirrors are widely available over HTTP and HTTPS, but the first mirror in the list is HTTPS, so the considerable majority of users will get packages over HTTPS—though since the second is HTTP, all it takes is DNS-blocking geo.mirror.pkgbuild.com to cause it to fetch over HTTP.) As for “so that HTTP caching servers have an opportunity to do their thing”: how much do public intermediaries do caching any more? I don’t know how popular that kind of thing ever was, though I know it did happen sometimes, but with how uncommon plain-text HTTP is now, I’d honestly expect most vendors to just drop that functionality as almost-unused complexity.
bawolff 3y ago
You mean like - https://justi.cz/security/2019/01/22/apt-rce.html https://justi.cz/security/2019/01/22/apt-rce.html? tbf, I'm being a bit hyperbolic. Its totally reasonable to have security at different layers. One good thing about HTTPS though is it is a very well tested layer. Crypto is such an easy thing to screw up, even when doing just basic stuff.

chrismorgan 3y ago

HTTPS is not just about tamper protection, but also about confidentiality. Do you want an attacker to be able to identify exactly which packages and which versions of packages you have installed? (Mind you, you’ll often be able to do a good job of guessing based on the side-channel leak of how much data is transferred.) See also: pervasive monitoring is an attack <https://www.rfc-editor.org/rfc/rfc7258.html https://www.rfc-editor.org/rfc/rfc7258.html>. I would expect all major operating systems to deliver their updates over HTTPS these days. (I know Arch Linux’s mirrors are widely available over HTTP and HTTPS, but the first mirror in the list is HTTPS, so the considerable majority of users will get packages over HTTPS—though since the second is HTTP, all it takes is DNS-blocking geo.mirror.pkgbuild.com to cause it to fetch over HTTP.) As for “so that HTTP caching servers have an opportunity to do their thing”: how much do public intermediaries do caching any more? I don’t know how popular that kind of thing ever was, though I know it did happen sometimes, but with how uncommon plain-text HTTP is now, I’d honestly expect most vendors to just drop that functionality as almost-unused complexity.

bawolff 3y ago

You mean like - https://justi.cz/security/2019/01/22/apt-rce.html https://justi.cz/security/2019/01/22/apt-rce.html? tbf, I'm being a bit hyperbolic. Its totally reasonable to have security at different layers. One good thing about HTTPS though is it is a very well tested layer. Crypto is such an easy thing to screw up, even when doing just basic stuff.