Re:Why does APT not use HTTPS?
by TedLePoireau on Monday January 21, 2019 @11:13AM
(#18961283)
The "Date, Valid-Until" timestamp mitigates replay-attack, cool.
But what if a vulnerability is discovered in a package and an MITM attack prevent you from downloading the new patched version, making you believe your system is up to date although it's not ?
[ Parent
| on HN ]
Re:Why does APT not use HTTPS?
by AstralStorm on Tuesday January 22, 2019 @03:42AM
(#18966904)
No, apt then shows a message about failing to download fresh update lists. For security repo, the period it's 10 days.