News for hackers. Stuff that matters.
Re:Debian apt security update: man-in-the-middle arbitrary c... by flotzam on Wednesday November 04, 2026 @08:30AM (#50365263)
Would it have killed them to give even a little bit of guidance how to securely update the apt package(s)?

If necessary, with instructions for downloading and verifying it out of band

Or maybe by passing a parameter to an old apt version that disables the vulnerable HTTP download resumption when downloading the new apt

Re:Debian apt security update: man-in-the-middle arbitrary c... by TZubiri on Wednesday November 04, 2026 @08:34AM (#50365315)
Use https?
Re:Debian apt security update: man-in-the-middle arbitrary c... by flotzam on Wednesday November 04, 2026 @08:38AM (#50365359)
Still requires trusting the server(s). But yes, they should have mentioned at least that
Re:Debian apt security update: man-in-the-middle arbitrary c... by flotzam on Wednesday November 04, 2026 @03:41PM (#50371202)

  apt -o Acquire::Retries=0 update &&
  apt -o Acquire::Retries=0 upgrade