News for hackers. Stuff that matters.
Re:Debian apt security update (man-in-the-middle) by vesinisa on Wednesday November 04, 2026 @01:19PM (#50369446)
Looks like you also found a similarly critical apt bug in 2019: https://lists.debian.org/debian-security-announce/2019/msg00...

Do you think there might be even more still lurking out there?

Re:Debian apt security update (man-in-the-middle) by justicz on Wednesday November 04, 2026 @01:22PM (#50369504)
I do. I think that security-critical but overly complex software like this should be rewritten and certain aspects of it formally verified, since such things are now practical.
Re:Debian apt security update (man-in-the-middle) by justicz on Wednesday November 04, 2026 @01:29PM (#50369605)
HTTPS would have mitigated this particular bug but it feels like rearranging deck chairs on the titanic to fight over that right now. We need to audit everything with powerful AI like, yesterday.
Re:Debian apt security update (man-in-the-middle) by solyin on Wednesday November 04, 2026 @02:16PM (#50370218)
I'm sure Debian was invited to take part in Project Glasswing back at the beginning of this year.

I wonder if all the people who laughed off Anthropic's sensationalistic claims about Mythos as marketing fluff have recanted, or if they're too busy patching, or maybe they're stochastically parroting Ed Zitron's latest blather.