16 ms·
TLS isn’t a major pet of the security of say APT, the key which signs the Release/Pacakges files is, and the process that provides the checksums to those files,
by midasuni 3y ago
TLS isn’t a major pet of the security of say APT, the key which signs the Release/Pacakges files is, and the process that provides the checksums to those files, and if you’ve compromised the developer it’s over anyway.
With an NSA able to generate a root cert as you say, I’d trust an apt package from a known provider way before the curl|bash stuff or YetAnotherPackageManagerBecause13ArentEnough that people prefer today.