6 ms·

Seems ironic their cert doesnt match and I get a browser warning. What happened to Debian? Is Security something they have only heard about in folklore terms?

Alupis 12y ago
Works fine for me. What browser are you using?
chimeracoder 12y ago
What browser are you using? I'm running Debian and it looks fine in Iceweasel.
throwaway5583 12y ago
The cert validates for me on firefox on windows as well as iceweasel on debian. I don't think debian is any less secure than other OSs.
TheHippo 12y ago
Looks fine: https://www.ssllabs.com/ssltest/analyze.html?d=lists.debian.org https://www.ssllabs.com/ssltest/analyze.html?d=lists.debian....
- hadoukenio 12y ago
  What about it? That's the URL for the Debian mailing list and not where packages are downloaded from. In fact, you download packages from Debian mirrors and most of these are over HTTP and not HTTPS. How do you know you're not downloading a compromised APT? Checksums you say? Don't forget you downloaded the package footprints via HTTP too! The MITM for APT is the elephant in the room here.
  - TimWolla 12y ago
    Luckily it only affected fetching the source and not the pre built binaries. Otherwise this would be a total nightmare.
    - hadoukenio 12y ago
      No, the nightmare is still there. Most Debian mirrors only serve HTTP and you most likely installed Debian from an ISO that you downloaded over HTTP. And when you did an md5 of the downloaded ISO you probably compared it to a fingerprint hosted on a website served via HTTP (at the same time forgetting that md5sum could have been compromised itself since you downloaded it via HTTP). Then when using APT to install packages, they too are being installed via HTTP.
      - TimWolla 12y ago
        apt checks the package signatures using GPG.
        hadoukenio 12y ago
        It checks and verifies using the tools you downloaded via HTTP which could have been compromised via MITM?
      - vWil 12y ago
        See https://wiki.debian.org/SecureApt https://wiki.debian.org/SecureApt and https://www.debian.org/CD/verify https://www.debian.org/CD/verify
  - nisa 12y ago
    Packages are signed using GPG keys from the package maintainers. The private keys are in an ideal world never even near the machine that serves the package to you.

Alupis 12y ago

Works fine for me. What browser are you using?

chimeracoder 12y ago

What browser are you using? I'm running Debian and it looks fine in Iceweasel.

throwaway5583 12y ago

The cert validates for me on firefox on windows as well as iceweasel on debian. I don't think debian is any less secure than other OSs.

TheHippo 12y ago

Looks fine: https://www.ssllabs.com/ssltest/analyze.html?d=lists.debian.org https://www.ssllabs.com/ssltest/analyze.html?d=lists.debian....

hadoukenio 12y ago
What about it? That's the URL for the Debian mailing list and not where packages are downloaded from. In fact, you download packages from Debian mirrors and most of these are over HTTP and not HTTPS. How do you know you're not downloading a compromised APT? Checksums you say? Don't forget you downloaded the package footprints via HTTP too! The MITM for APT is the elephant in the room here.
- TimWolla 12y ago
  Luckily it only affected fetching the source and not the pre built binaries. Otherwise this would be a total nightmare.
  - hadoukenio 12y ago
    No, the nightmare is still there. Most Debian mirrors only serve HTTP and you most likely installed Debian from an ISO that you downloaded over HTTP. And when you did an md5 of the downloaded ISO you probably compared it to a fingerprint hosted on a website served via HTTP (at the same time forgetting that md5sum could have been compromised itself since you downloaded it via HTTP). Then when using APT to install packages, they too are being installed via HTTP.
    - TimWolla 12y ago
      apt checks the package signatures using GPG.
      - hadoukenio 12y ago
        It checks and verifies using the tools you downloaded via HTTP which could have been compromised via MITM?
    - vWil 12y ago
      See https://wiki.debian.org/SecureApt https://wiki.debian.org/SecureApt and https://www.debian.org/CD/verify https://www.debian.org/CD/verify
- nisa 12y ago
  Packages are signed using GPG keys from the package maintainers. The private keys are in an ideal world never even near the machine that serves the package to you.