News for hackers. Stuff that matters.

A comment on Why does APT not use HTTPS?. Parent comment

Re:Why does APT not use HTTPS? by niea_11 on Monday January 21, 2019 @05:01AM (#18959175)
The website mentions this towards the end (Replay attacks) : To mitigate this problem, APT archives includes a timestamp after which all the files are considered stale

The time stamp is described here[1], but it is not clear how the expiration date is decided.

1: https://wiki.debian.org/DebianRepository/Format#Date.2C_Vali...

[ Parent | on HN ]
Re:Why does APT not use HTTPS? by julian-klode on Monday January 21, 2019 @05:06AM (#18959196)
Well, defining the expiration date is up to the server. Debian picks a week. Ubuntu does not use it, I have started a launchpad branch last year, but um, I don't know launchpad, so it might take some more years ;)
[ Parent | on HN ]