3 ms·
Man-in-the-middle attacks. But equally important, many secure environments won't allow outbound http connections.
by atgreen 3y ago
Man-in-the-middle attacks. But equally important, many secure environments won't allow outbound http connections.
- akho 3y agoWhat kind of mitm? The attacker cannot modify what you get. You leak the list of packages you download, but I don't think https by itself would have helped — host and filesize would be known, and that should be enough.
- isityouyesitsme 3y agohttps also provides secure authentication, not merely encryption. The encryption part also guarantees the authentication part by proving that the stream can not have been modified. In order to meet this guarantee for the scheme you're discussing, the hashes themselves need to have a tamper evident. What is this tamper evident?
- akho 3y agoYes, that's clear. I'm not very familiar with how quicklisp works. I thought that “updates once a month” implies a separate update channel (distribution, ...). Looking at the relevant issue, https://github.com/quicklisp/quicklisp-client/issues/167 https://github.com/quicklisp/quicklisp-client/issues/167 , it's not clear that even hashes are in place. I recently found out that most Nix fetchers use https, but do not actually do verification (`curl --insecure` or equivalent libcurl settings). Channel updates do verify and include hashes, so the overall chain is authenticated.