Re:Debian apt security update: man-in-the-middle arbitrary c...
by Avamander on Friday November 06, 2026 @07:24AM
(#50391527)
> Does it?
It clearly doesn't. I guess we'll wait for the next RCE to learn our lesson.
> [...] vs all the bugs and issues with any code in the SSL layer.
You keep calling it SSL, that already makes me suspect that you have a few outdated preconceptions. Today you can use a formally proven TLS implementation, if you're so inclined. Formally proven APT? Will never happen.
If TLS is used, it significantly reduces the surface area exposed to anyone who can access or tamper with the traffic. None of the code that literally made an RCE possible would be accessible in the vast majority of cases.
Imagine if we would have had TLS used with APT everywhere right now, the threat would have been "if NSA MiTMs you with the certificates they can generate". Drastic difference in terms of scale, sophistication and likelyhood of it happening.
It clearly doesn't. I guess we'll wait for the next RCE to learn our lesson.
> [...] vs all the bugs and issues with any code in the SSL layer.
You keep calling it SSL, that already makes me suspect that you have a few outdated preconceptions. Today you can use a formally proven TLS implementation, if you're so inclined. Formally proven APT? Will never happen.
If TLS is used, it significantly reduces the surface area exposed to anyone who can access or tamper with the traffic. None of the code that literally made an RCE possible would be accessible in the vast majority of cases.
Imagine if we would have had TLS used with APT everywhere right now, the threat would have been "if NSA MiTMs you with the certificates they can generate". Drastic difference in terms of scale, sophistication and likelyhood of it happening.