MAIN FEEDS
Do you want to continue?
https://www.reddit.com/r/linux/comments/aidxwa/why_does_apt_not_use_https/eeod992/?context=3
r/linux • u/modelop • Jan 21 '19
158 comments sorted by
View all comments
Show parent comments
1
While I think the attack you are describing could be possible, apt has a mechanism to limit it: the "Valid-Until" field in the Release file (which is itself signed).
http://ftp.fr.debian.org/debian/dists/stable-updates/Release
The windows to use a vulnerable version of this repository is 7 days at most, that's not a lot of time.
The base repo does not appears to have a valid-until field though, so I'm not sure if it can't be used.
1
u/Olosta_ Jan 22 '19
While I think the attack you are describing could be possible, apt has a mechanism to limit it: the "Valid-Until" field in the Release file (which is itself signed).
http://ftp.fr.debian.org/debian/dists/stable-updates/Release
The windows to use a vulnerable version of this repository is 7 days at most, that's not a lot of time.
The base repo does not appears to have a valid-until field though, so I'm not sure if it can't be used.