News for hackers. Stuff that matters.

A comment on Remote code execution vulnerability in apt/apt-get. Parent comment

Re:Remote code execution vulnerability in apt/apt-get by hannob on Tuesday January 22, 2019 @11:57AM (#18969735)
HTTPS: A malicious mirror operator can pwn you.

HTTP: Everyone can pwn you.

Not saying the first one is ideal, but the second one is definitely worse.

[ Parent | on HN ]
Re:Remote code execution vulnerability in apt/apt-get by trulyrandom on Tuesday January 22, 2019 @01:25PM (#18970784)
With HTTP an attacker still has to MITM the connection between you and the mirror operator. So, definitely not "everyone".
[ Parent | on HN ]
Re:Remote code execution vulnerability in apt/apt-get by cryptonector on Tuesday January 22, 2019 @06:01PM (#18973550)
That includes: coffee shops, ISPs, employers, everyone who can hack their routers, anyone who can spoof DNS, etc. That might as well be "everyone".

STOP IT. Though shall use HTTPS.

[ Parent | on HN ]
Re:Remote code execution vulnerability in apt/apt-get by trulyrandom on Wednesday January 23, 2019 @02:44PM (#18981952)
Fair enough. I agree that HTTPS is valuable here. I was just being overly pedantic, my bad.
[ Parent | on HN ]
Re:Remote code execution vulnerability in apt/apt-get by DoctorOetker on Tuesday January 22, 2019 @02:17PM (#18971378)
the moment we are talking about monitoring user's software base, we are practically already talking attackers at the skill level of nation states, so yeah "everyone" in the subset of plausible attackers.
[ Parent | on HN ]