5 ms·

Remove unofficial debian-multimedia.org repository from your sources

126 points by mfincham 13y ago

gizmo686 13y ago
Doesn't apt verify the signature of packages before it installs them? If so, then the new domain owner shouldn't be able to do anything malicious because (s)he cannot sign the packages.
- mfincham 13y ago
  I'd say it's still pretty risky to leave this source enabled. The behaviour shown at http://wiki.debian.org/SecureApt#How_apt_uses_Release.gpg http://wiki.debian.org/SecureApt#How_apt_uses_Release.gpg is what a user would see if the entire repository (including the Release.gpg file) were swapped out. Unfortunately a decent percentage of the people using debian-multimedia.org likely never imported the signing keys for the original repository at all, and wouldn't notice that the key ID had changed. Even if they had previously installed the key, all they would get is that warning during package installation if a rogue repository was established, something which is fairly common and likely to be ignored by a good portion of the user base. In the past even very savvy folks (Defcon attendees) have fallen afoul of accepting dodgy package updates: http://seclists.org/fulldisclosure/2011/Aug/76 http://seclists.org/fulldisclosure/2011/Aug/76 Edit: I recalled hearing that they'd Mitm'd Debian / Ubuntu updates but now I can't find that specific factoid again, so perhaps take the Defcon thing with a grain of salt.
  - ars 13y ago
    He has a package deb-multimedia-keyring, and I actually think most users install it because if you don't apt-get complains.
  - dfc 13y ago
    I have never seen such rampant speculation before. I think you should change your addendum to read "take this entire comment with a grain of salt." This gem really takes the cake: Even if they had previously installed the key, all they would get is that warning during package installation if a rogue repository was established, something which is fairly common You see so many "rogue repositories" that you think they are common? I have never had one.
    - mfincham 13y ago
      You're right, I didn't word that well at all. I meant it's fairly common to see apt complaining about not having the key available to verify a package. I see this a lot in my work where sysadmins lacking clue enable a third party repository and don't bother / don't understand the need for adding the key with apt-key.
  - mike-cardwell 13y ago
    I would say that the user should be forced to install the correct GPG key, however in this case I imagine the attacker would just put up their own key on a "fake" website on the compromised domain and people would then install that. Or just ignore the warning.
ars 13y ago
You shouldn't remove it, you should change it to http://www.deb-multimedia.org/ http://www.deb-multimedia.org/ . It's cute how debian thinks you should remove it completely (it sounds like they are insulted actually). There are plenty of packages in deb-multimedia that are not in debian, like mythtv, avidemux, xbmc, cinelerra. And some are simply better in deb-multimedia like mplayer which is compiled with many more formats then are available in the stock debian version. Christian Marillat should get a huge amount of credit for keeping this running, even with all the flak he gets from debian sometimes.
- mfincham 13y ago
  Thanks for pointing that out, more info about why the name was changed is on the Debian list server: http://lists.alioth.debian.org/pipermail/pkg-multimedia-maintainers/2012-May/026678.html http://lists.alioth.debian.org/pipermail/pkg-multimedia-main...
  - ars 13y ago
    It's really not nice how they treated him. In general his packages are better than the debian ones (where they duplicate). Harm to users - right. I've been using dmo for at least 7 years and if I had any problems in that time I don't remember it.
    - lordgilman 13y ago
      At the same time, Stefan (the DPL) asked nicely [1] twice, a year ago, for the owner to transfer the domain to Debian. He even had the foresight to point out the renewal race condition which Debian lost recently resulting in the press release. The debian-multimedia guy is just being spiteful at this point given that Debian's been nothing but diplomatic. [1] http://lists.alioth.debian.org/pipermail/pkg-multimedia-maintainers/2012-May/027482.html http://lists.alioth.debian.org/pipermail/pkg-multimedia-main...
      - ars 13y ago
        > Debian's been nothing but diplomatic. No they weren't. They kept insulting him. I personally would have overlooked that and transferred it anyway, but I can understand why he didn't. Must have been a tough time for him.
jabiko 13y ago
It seems like deb(ian)-multimedia was asked to stop using "debian" as a part of the domain name [1]. But I don't see why they decided to let the domain expire instead of setting up a redirect. [1] http://lists.alioth.debian.org/pipermail/pkg-multimedia-maintainers/2012-May/thread.html#26678 http://lists.alioth.debian.org/pipermail/pkg-multimedia-main...
Nursie 13y ago
No, change unofficial debian-multimedia repo to deb-multimedia. You probably had a reason to use debian-multimedia, its packages have a lot better codec support (amongst other things) than the mainline, so you probably still have a reason to use deb-multimedia. It's the first thing I install on new debian systems and has been for years. I'm not sure why the debian guys decided to get pissy about it, as far as I can tell the guy is doing them and their users a huge favour.
J_Darnley 13y ago
So this means that Linux is just as bad as Windows when it comes to installing software from a random website.
- kintamanimatt 13y ago
  This doesn't mean that at all. This is the first time I've seen the domain that hosted a trustworthy repo go bye-bye.
  - J_Darnley 13y ago
    So its really about trust then? You trust this website to provide what you want and nothing more. You may also trust other websites that provide up-to-date packages when your distro won't. You may also trust a website to provide software that your distro doesn't. Why is this any safer for the clueless user?
    - Nursie 13y ago
      The clueless user won't be using debian. The clueless user who's somehow found themselves in possession of a debian system won't be adding third party repos to debian. The clueless user who's somehow found themselves with a debian system with third party repos installed will be informed when the repository keys change and warned not to install the software because it can't be verified. This is not a case of google->download->double click->virus like windows has had for so long.
      - dagw 13y ago
        I've met plenty of eager 'leet' computer geeks whom are perfectly willing and capable of installing Debian, blindly following howtos and copying and pasting text from forums until they have a working system, and still completely clueless when it comes to general computer security or any other big picture aspect of how Linux works. Hell if I'm to be perfectly honest I think I just described myself the first time I sat down with a spare computer and a big pile of Slackware floppies.

126 points by mfincham 13y ago

Doesn't apt verify the signature of packages before it installs them? If so, then the new domain owner shouldn't be able to do anything malicious because (s)he cannot sign the packages.

mfincham 13y ago
I'd say it's still pretty risky to leave this source enabled. The behaviour shown at http://wiki.debian.org/SecureApt#How_apt_uses_Release.gpg http://wiki.debian.org/SecureApt#How_apt_uses_Release.gpg is what a user would see if the entire repository (including the Release.gpg file) were swapped out. Unfortunately a decent percentage of the people using debian-multimedia.org likely never imported the signing keys for the original repository at all, and wouldn't notice that the key ID had changed. Even if they had previously installed the key, all they would get is that warning during package installation if a rogue repository was established, something which is fairly common and likely to be ignored by a good portion of the user base. In the past even very savvy folks (Defcon attendees) have fallen afoul of accepting dodgy package updates: http://seclists.org/fulldisclosure/2011/Aug/76 http://seclists.org/fulldisclosure/2011/Aug/76 Edit: I recalled hearing that they'd Mitm'd Debian / Ubuntu updates but now I can't find that specific factoid again, so perhaps take the Defcon thing with a grain of salt.
- ars 13y ago
  He has a package deb-multimedia-keyring, and I actually think most users install it because if you don't apt-get complains.
- dfc 13y ago
  I have never seen such rampant speculation before. I think you should change your addendum to read "take this entire comment with a grain of salt." This gem really takes the cake: Even if they had previously installed the key, all they would get is that warning during package installation if a rogue repository was established, something which is fairly common You see so many "rogue repositories" that you think they are common? I have never had one.
  - mfincham 13y ago
    You're right, I didn't word that well at all. I meant it's fairly common to see apt complaining about not having the key available to verify a package. I see this a lot in my work where sysadmins lacking clue enable a third party repository and don't bother / don't understand the need for adding the key with apt-key.
- mike-cardwell 13y ago
  I would say that the user should be forced to install the correct GPG key, however in this case I imagine the attacker would just put up their own key on a "fake" website on the compromised domain and people would then install that. Or just ignore the warning.

ars 13y ago

You shouldn't remove it, you should change it to http://www.deb-multimedia.org/ http://www.deb-multimedia.org/ . It's cute how debian thinks you should remove it completely (it sounds like they are insulted actually). There are plenty of packages in deb-multimedia that are not in debian, like mythtv, avidemux, xbmc, cinelerra. And some are simply better in deb-multimedia like mplayer which is compiled with many more formats then are available in the stock debian version. Christian Marillat should get a huge amount of credit for keeping this running, even with all the flak he gets from debian sometimes.

mfincham 13y ago
Thanks for pointing that out, more info about why the name was changed is on the Debian list server: http://lists.alioth.debian.org/pipermail/pkg-multimedia-maintainers/2012-May/026678.html http://lists.alioth.debian.org/pipermail/pkg-multimedia-main...
- ars 13y ago
  It's really not nice how they treated him. In general his packages are better than the debian ones (where they duplicate). Harm to users - right. I've been using dmo for at least 7 years and if I had any problems in that time I don't remember it.
  - lordgilman 13y ago
    At the same time, Stefan (the DPL) asked nicely [1] twice, a year ago, for the owner to transfer the domain to Debian. He even had the foresight to point out the renewal race condition which Debian lost recently resulting in the press release. The debian-multimedia guy is just being spiteful at this point given that Debian's been nothing but diplomatic. [1] http://lists.alioth.debian.org/pipermail/pkg-multimedia-maintainers/2012-May/027482.html http://lists.alioth.debian.org/pipermail/pkg-multimedia-main...
    - ars 13y ago
      > Debian's been nothing but diplomatic. No they weren't. They kept insulting him. I personally would have overlooked that and transferred it anyway, but I can understand why he didn't. Must have been a tough time for him.

jabiko 13y ago

It seems like deb(ian)-multimedia was asked to stop using "debian" as a part of the domain name [1]. But I don't see why they decided to let the domain expire instead of setting up a redirect. [1] http://lists.alioth.debian.org/pipermail/pkg-multimedia-maintainers/2012-May/thread.html#26678 http://lists.alioth.debian.org/pipermail/pkg-multimedia-main...

Nursie 13y ago

No, change unofficial debian-multimedia repo to deb-multimedia. You probably had a reason to use debian-multimedia, its packages have a lot better codec support (amongst other things) than the mainline, so you probably still have a reason to use deb-multimedia. It's the first thing I install on new debian systems and has been for years. I'm not sure why the debian guys decided to get pissy about it, as far as I can tell the guy is doing them and their users a huge favour.

J_Darnley 13y ago

So this means that Linux is just as bad as Windows when it comes to installing software from a random website.

kintamanimatt 13y ago
This doesn't mean that at all. This is the first time I've seen the domain that hosted a trustworthy repo go bye-bye.
- J_Darnley 13y ago
  So its really about trust then? You trust this website to provide what you want and nothing more. You may also trust other websites that provide up-to-date packages when your distro won't. You may also trust a website to provide software that your distro doesn't. Why is this any safer for the clueless user?
  - Nursie 13y ago
    The clueless user won't be using debian. The clueless user who's somehow found themselves in possession of a debian system won't be adding third party repos to debian. The clueless user who's somehow found themselves with a debian system with third party repos installed will be informed when the repository keys change and warned not to install the software because it can't be verified. This is not a case of google->download->double click->virus like windows has had for so long.
    - dagw 13y ago
      I've met plenty of eager 'leet' computer geeks whom are perfectly willing and capable of installing Debian, blindly following howtos and copying and pasting text from forums until they have a working system, and still completely clueless when it comes to general computer security or any other big picture aspect of how Linux works. Hell if I'm to be perfectly honest I think I just described myself the first time I sat down with a spare computer and a big pile of Slackware floppies.