News for hackers. Stuff that matters.

A comment on Debian apt security update (man-in-the-middle). Parent comment

Re:Debian apt security update (man-in-the-middle) by sczi on Wednesday November 04, 2026 @11:39AM (#50368128)
Nice work! A similar vulnerability in 2019 also found by you included the recommendation to update with:

  apt -o Acquire::http::AllowRedirect=false update
  apt -o Acquire::http::AllowRedirect=false upgrade
Since this also involves redirects, would that protect users while updating apt for this one also?
[ Parent | on HN ]
Re:Debian apt security update (man-in-the-middle) by justicz on Wednesday November 04, 2026 @01:16PM (#50369413)
That sounds right to me, but FYI the APT maintainers themselves are recommending Acquire::Retries=0 as the mitigation since some mirrors might actually have redirects.
[ Parent | on HN ]
Re:Debian apt security update (man-in-the-middle) by winny314 on Wednesday November 04, 2026 @08:42PM (#50373995)
I saw the ubuntu announcement also defers to the `apt upgrade -o Acquire::Retries=0` recommendation

https://ubuntu.com/blog/apt-vulnerability-fixes-available

[ Parent | on HN ]