Debian apt security update: man-in-the-middle arbitrary code execution

Re:Debian apt security update: man-in-the-middle arbitrary c... by iamnothere on Wednesday November 04, 2026 @08:57AM (#50365576)

Bonus, the man in the middle can see what packages you’re downloading since you’re not using HTTPS, so they know if you’re vulnerable during an update.

I never understood the insistence on using HTTP as a default for apt. Once HTTPS transport was available and tested (which took forever btw) then it should have become the default. Maybe this will spur some changes.

[ Parent | on HN ]

Re:Debian apt security update: man-in-the-middle arbitrary c... by ducktective on Wednesday November 04, 2026 @09:06AM (#50365697)

How to cache with HTTPS?

[ Parent | on HN ]

Re:Debian apt security update: man-in-the-middle arbitrary c... by iamnothere on Wednesday November 04, 2026 @09:09AM (#50365754)

SSL bumping

[ Parent | on HN ]

Re:Debian apt security update: man-in-the-middle arbitrary c... by Avamander on Wednesday November 04, 2026 @09:12AM (#50365794)

If your scale actually makes caching worth it you can run a local HTTPS mirror. If you don't control the endpoints to do that, you don't get to MiTM anything.

[ Parent | on HN ]

Re:Debian apt security update: man-in-the-middle arbitrary c... by sznio on Wednesday November 04, 2026 @09:15AM (#50365845)

give the cache server a certificate?

[ Parent | on HN ]

Re:Debian apt security update: man-in-the-middle arbitrary c... by cbluth on Wednesday November 04, 2026 @09:55AM (#50366401)

https://wiki.squid-cache.org/Features/SslPeekAndSplice

[ Parent | on HN ]

Re:Debian apt security update: man-in-the-middle arbitrary c... by yread on Wednesday November 04, 2026 @03:44PM (#50371239)

how do you apt install ca-certificates

[ Parent | on HN ]

Re:Debian apt security update: man-in-the-middle arbitrary c... by doublepg23 on Wednesday November 04, 2026 @04:50PM (#50372053)

wouldn't it come with your install?

[ Parent | on HN ]