3 ms·

Because it doesn't do any good to serve over SSL. They do provided GPG signatures and checksums which provide assurance that the bits you wanted are the bits yo

by timtadh 12y ago

Because it doesn't do any good to serve over SSL. They do provided GPG signatures and checksums which provide assurance that the bits you wanted are the bits you got. Ex. http://download.documentfoundation.org/libreoffice/src/4.4.0/libreoffice-4.4.0.3.tar.xz.mirrorlist http://download.documentfoundation.org/libreoffice/src/4.4.0... https://www.gnupg.org/gph/en/manual/x135.html https://www.gnupg.org/gph/en/manual/x135.html

M4v3R 12y ago
How good the signatures are if they are served from HTTP as well? It only serves as an integrity check, but it still won't guard you from a malicious person putting a virus into the package and adjusting the signatures.
- jahewson 12y ago
  That won't work though, only the person who posses the private key can produce a valid GPG signature.
- rlpb 12y ago
  If you're validating the signatures properly, then it's impossible for a malicious attacker to adjust the signatures in a way that they will still validate. However, validating the signature properly involves you being certain of using the correct public key. This is the tricky part. Being in the PGP strong set helps with this. Using HTTPS gives you some confidence, but no protection against server compromise. Once you do have the correct public key, however, you can be protected against server compromise for all future releases, too. Or, at the least, you can verify that future releases are coming unmodified from the same origin.
tombrossman 12y ago
What is good (and often overlooked) about package updates over HTTPS is that you don't leak metadata about which packages you are updating or installing. Not a big issue with an office suite but still it's an option I would prefer.
nhaehnle 12y ago
Sorry, but such a strong claim requires more justification. From what I know, it is orders of magnitude harder to hijack a package download over HTTPS than over HTTP. It is technically feasible for me to sit in a random coffee shop and do a drive-by infection of .exe files downloaded via HTTP by arbitrary other people on the same WLAN. The same is not true for HTTPS, because I am not able to forge arbitrary SSL certificates. Yes, there are problems with SSL, but to claim that "it doesn't do any good" seems wrong.

by timtadh 12y ago

M4v3R 12y ago

How good the signatures are if they are served from HTTP as well? It only serves as an integrity check, but it still won't guard you from a malicious person putting a virus into the package and adjusting the signatures.

jahewson 12y ago
That won't work though, only the person who posses the private key can produce a valid GPG signature.
rlpb 12y ago
If you're validating the signatures properly, then it's impossible for a malicious attacker to adjust the signatures in a way that they will still validate. However, validating the signature properly involves you being certain of using the correct public key. This is the tricky part. Being in the PGP strong set helps with this. Using HTTPS gives you some confidence, but no protection against server compromise. Once you do have the correct public key, however, you can be protected against server compromise for all future releases, too. Or, at the least, you can verify that future releases are coming unmodified from the same origin.

tombrossman 12y ago

What is good (and often overlooked) about package updates over HTTPS is that you don't leak metadata about which packages you are updating or installing. Not a big issue with an office suite but still it's an option I would prefer.

nhaehnle 12y ago

Sorry, but such a strong claim requires more justification. From what I know, it is orders of magnitude harder to hijack a package download over HTTPS than over HTTP. It is technically feasible for me to sit in a random coffee shop and do a drive-by infection of .exe files downloaded via HTTP by arbitrary other people on the same WLAN. The same is not true for HTTPS, because I am not able to forge arbitrary SSL certificates. Yes, there are problems with SSL, but to claim that "it doesn't do any good" seems wrong.