Tell HN: Linux Mint still serves their hash sums from http not https
11 comments
On a slightly related topic, ubuntu apt-gets are still usually served on http. Dodgy.
I don't know the details but any packages that you get served should include pgp signatures, that apt should verify before installation.
Private keys can be stolen or extracted via bribery, etc.
Are you saying if ubuntu served apt-gets over https, stolen private keys wouldn't be a problem?
Multiple layers of security is industry practice.
Sure. In this particular setting, having both https and pgp is definitely better and a third layer would be even better, though I cannot think of one. Successful transfer from https Ubuntu mirror says my package was not tampered with during transmission, but nothing about the validity and integrity of the package itself. The Ubuntu project most likely does not have absolute control over the various mirrors available to users, so pgp verification provides a further assurance that mere https cannot.
If I had to chose between https and pgp, I would pick pgp. The OpenBSD project has a similar scheme (called signify).
If I had to chose between https and pgp, I would pick pgp. The OpenBSD project has a similar scheme (called signify).
This is relevant because their ISO's have been already compromised once.[0]
[0]: https://news.ycombinator.com/item?id=11149839
[0]: https://news.ycombinator.com/item?id=11149839
[0]: https://linuxmint.com/verify.php
[1]: http://mint-mirror.gwendallebihan.net/isos/stable/18.1/sha256sum.txt