News for hackers. Stuff that matters.

A comment on Debian apt security update: man-in-the-middle arbitrary code execution.

Re:Debian apt security update: man-in-the-middle arbitrary c... by londons_explore on Wednesday November 04, 2026 @09:16AM (#50365861)
And APT was the one being very reluctant about using HTTPS because "we sign out stuff so don't need encryption".

I think this demonstrates exactly why everything should be https.

[ Parent | on HN ]
Re:Debian apt security update: man-in-the-middle arbitrary c... by teddyh on Wednesday November 04, 2026 @09:20AM (#50365911)
HTTPS will not protect you from a bad/compromised mirror.
[ Parent | on HN ]
Re:Debian apt security update: man-in-the-middle arbitrary c... by Avamander on Wednesday November 04, 2026 @09:22AM (#50365933)
A bad mirror is much less likely than someone MiTMing, at least for most machines.
[ Parent | on HN ]
Re:Debian apt security update: man-in-the-middle arbitrary c... by TacticalCoder on Wednesday November 04, 2026 @11:52AM (#50368313)
Wait: Debian packages are signed.

A compromised mirror cannot serve packages that aren't properly signed.

This attack used an HTTP redirect to serve a backdoored package after the signature has been verified. I'm not sure that HTTP redirect attack would work with an HTTPS repository!?

[ Parent | on HN ]
Re:Debian apt security update: man-in-the-middle arbitrary c... by leni536 on Wednesday November 04, 2026 @12:13PM (#50368576)
Why wouldn't it work on a compromised mirror? HTTPS servers can still do redirects.
[ Parent | on HN ]