News for hackers. Stuff that matters.
Re:Debian apt security update: man-in-the-middle arbitrary c... by krautsauer on Wednesday November 04, 2026 @08:48AM (#50365463)
Easier to put caching proxies on the path?
Re:Debian apt security update: man-in-the-middle arbitrary c... by Avamander on Wednesday November 04, 2026 @09:07AM (#50365720)
Who actually does that this day and age?
Re:Debian apt security update: man-in-the-middle arbitrary c... by tremon on Wednesday November 04, 2026 @09:58AM (#50366444)
I do. Helps massively when seeding virtual machines using auto-install scripts.
Re:Debian apt security update: man-in-the-middle arbitrary c... by moebrowne on Wednesday November 04, 2026 @12:22PM (#50368673)
Same. It's faster and feels respectful to not keeping hitting freely provided repos for the same packages over and over. Someone has to be paying for the bandwidth.
Re:Debian apt security update: man-in-the-middle arbitrary c... by krautsauer on Wednesday November 04, 2026 @07:26PM (#50373374)
Thinking about it, that's not a good argument for http being the default. If you're seeding VMs, you're already in control of the config. Using a dedicated repository proxy (apt-cacher-ng? sonatype nexus? pulp? something?) might even perform better than a generic caching proxy.
Re:Debian apt security update: man-in-the-middle arbitrary c... by tremon on Friday November 06, 2026 @05:57AM (#50390796)
Yes, I use acng. I still consider it a caching proxy, even if it's an application-specific one.
Re:Debian apt security update: man-in-the-middle arbitrary c... by elboulangero on Wednesday November 04, 2026 @11:42AM (#50368170)
Developers
Re:Debian apt security update: man-in-the-middle arbitrary c... by Avamander on Wednesday November 04, 2026 @01:41PM (#50369759)
So a minuscule part of the install base that can absolutely alter system configuration to use a local mirror.

Not something that should be the default, exposing everyone to the dangers.