Debian: "We don't need to use HTTPS, we sign our packages! Check out whydoesaptnotusehttps[.]com!"
https://lists.debian.org/debian-security-announce/2019/msg00010.html …
https://justi.cz/security/2019/01/22/apt-rce.html …
Oops.
*This* is why you use HTTPS. Defense in depth. Take note @videolan.
-
A condescending note never helps, you know.
Some people don't learn until they get pwned (or get shown how people get pwned) - this is how @videolan closed the ticket with "no threat model, no proof". HTTPS is *still* a good idea even if you think your update signature model is bulletproof, for exactly this kind of reason.
-
-
Your note is appreciated as it was appreciated in the other threads. Your help in implementing what you propose would be certainly welcome
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.