4 ms·
The problem is that in this scenario, the GPG key and signature serves no practical purpose. The whole security, whether GPG is invoked or not, relies on the s
by acveilleux 12y ago
The problem is that in this scenario, the GPG key and signature serves no practical purpose.
The whole security, whether GPG is invoked or not, relies on the security of the HTTPS connection alone.
If the HTTPS cannot be trusted alone, then everything is lost as a compromised HTTPS connection can be used supply both a comprimised GPG key and a compromised package, or, indeed, anything at all that is legal to `| sudo bash`...
And HTTPS security boils down to:
1. The difficulty of altering (or exploiting privileged position wrt) the global routing table to setup MitM or MitS scenarios.
2. The difficulty of obtaining a valid looking certificate for an arbitrary domain.
Any situation where a government actor is the adversary poses intractable challenges to both 1 and 2 above. (And before you say NSA/GCHQ would never care about XYZ, consider China...
- emn13 12y agoEven if you trust "normal" https certificates, it's still a much more risky proposition. Those certificates only really say that somebody control the domain - not (in general) that he actually owns it or is responsible in any way, and, more critically, don't vet whether somebody is trustworthy or not. You can easily get some other similar-sounding domain as a malicious agent, and validly get an https certificate for that. So even if you trust https works, it's still a tricky proposition - it's not really similar to a distro's package distribution channel.
- acveilleux 12y agoIndeed, and I didn't even go over trusting the actual source of the bash script or the security/integrity of the server(s) it's hosted on even if the cert is all A-OK.
- lmm 12y agoIt gives people a way to choose the level of security they care about. Those who are willing to trust HTTPS can trust HTTPS. Those who aren't can obtain the GPG key and check its signature by another mechanism (WoT) and manually verify the package signature.
- acveilleux 12y agoThose who would go out of their way to do the GPG check are also the same people who are horrified by `curl .... | sudo bash`
- lmm 12y agoYes, that's the point. Those who aren't horrified can do that. Those who are can get the package "by hand" and do the GPG check themselves.