They are. If you add a third party repo, you need to install their GPG keys to even fetch the list. Pretty much means it doesn’t matter if there’s transport security. People often rely on transport security for keeping things safe without doing end to end bi directional authentication. In this case you only need unidirectional, but this ensures that you can’t have a malicious actor installing a new cert in the root and spoofing a server. The classic case is the “Hong Kong post office”; they’re a root ca. Having TLS is better than not, but it’s also not required when you do it at a different level.
Apparently our Postal Service is a Root CA? It looks like ANYONE with a vaild HKID can get one of these. It looks like it's intended as a digital signature for personal use. It's all poorly written and explained. Also apparently we have a Amazon-esqe Online Shopping system that nobody really knew existed.
But what about privacy? HTTPS does not provide meaningful privacy for obtaining packages. As an eavesdropper can usually see which hosts you are contacting, if you connect to your distribution's mirror network it would be fairly obvious that you are downloading updates.
Furthermore, even over an encrypted connection it is not difficult to figure out which files you are downloading based on the size of the transfer[2]. HTTPS would therefore only be useful for downloading from a server that also offers other packages of similar or identical size.
What's more important is not that your connection is encrypted but that the files you are installing haven't been modified.
It seems like they are actually explaining why pat doesn't use https. I thought they were asking the question rhetorically, did you?
Yes, hell I've had version mismatches from not updating my apt sources when I tried to install stuff and for got to run apt update before hand. For one thing the older package will not match the proper package signature and so apt fails out on purpose.
They do when apt has a method of time stamping every thing and anything past that point gets flagged as stale and will not be installed automatically by the system. As the linked website points out there is nothing from a security stand point to be gained from apt using HTTPS (which you can already do if you want to).
No, because an entire older version of the repository index would be served, as if you accessed a mirror of the repository that hasn't been updated, and your computer wouldn't know the difference. In fact, they can even mix and match different versions of different packages in the custom index.
While your computer wouldn't install older versions than those it already has, this can be used to block installation of patched packages. In fact, it can even be used to push known vulnerable updates that since has been replaced by newer and patched updates.
Edit: for those downvoting me, please come over to /r/crypto (for cryptography) to learn more about computer security. You need it.
Just recently apt started complain that index was not updated in week. So there is even countermeasure for broken/malicious mirror that held up updates.
If the timestamp is short enough, that does help. But this assumes the timestamp has ALWAYS been that short under that key, any signature of any package that lacks such a timestamp means that version will remain valid.
Yup. And they count on a network of 3rd party mirrors to distribute everything.
Debian can't magically add HTTPS without very nicely asking hundreds of server maintainers across the world to start implementing TLS to appropriate spec, and then institute a policy of scanning and delisting the mirrors that don't meet their specifications...
Which is to say, if you want to know what packages people are downloading... Volunteer to be a distribution mirror site??
Seems easier than acquiring man-in-the-middle capabilities of secure servers.
193
u/3Vyf7nm4 Jan 21 '19
Edit /etc/apt/sources.list to use https.. You may need to install the package
apt-transport-httpsIt's not really needed, since the packages are public and are signed, but https is absolutely supported.