Re:Debian apt security update: man-in-the-middle arbitrary c...
by edelbitter on Thursday November 05, 2026 @03:45PM
(#50384248)
I found the /etc/apt/sources.list.d/lexicographic-order.list to /etc/apt/sources.list.d/lexicographic-order.sources (Debian RFC822 control data format) migration well-planned: the old format will not stop working before 2029, just newly installed or upgraded systems will not default to it any more. Unless an admin specifically deployed no longer compatible files to a newer release, without even checking how the folder looks there, this slow changeover won't break much. Which is the sort of planning I value Debian for, and hope for whatever cleanup the mirrorlist plus http-redirect bit eventually gets. (There is additionally the somewhat related pdiffs feature, which could suffer from the same category of time-of-check/time-of-use bugs - but that one already is configurable per-repository and less seriously harmful if disabled on a supporting source.)
There's need if your apt client hits a redirector that redirects to a mirror close-by. That's the default for Kali Linux, so it's very much needed.
This being said Debian's default deb.debian.org is a CDN, so maybe disabling redirects by default in Debian, and letting downstream distros enable if if needed, might be a good idea.
However when you change a long-standing setting like that, hard to know in advance what will break...
And as others noted, mirror sysadmins might use redirects in their webserver config. So if you disable the setting, users that hit a mirror might face apt errors, that can be a lot of users impacted.