Debian Developers: Given how trivial it is to crack eMudhra's certs[1], isn't HTTPS useless as a mitigation[2] for CVE-2026-109518[3] wrt new installations? It's bad enough that new ISOs for 26.10 and 26.04 LTS weren't released following the cert compromise, but given the APT vuln, any coffee shop skid or ISP technician can trivially pwn a new installation of Debian *at first upgrade time*. Having unattended-upgrades enabled by default actually makes this *far worse*, since users are likely to have their system autoupgrade 24 hours after installation, *without* `-o Acquire::Retries=0` set! Considering the rate at which users are migrating away from Winglows 11 to GNU+Linux, the number of new Debian laptop users is surely growing all the time.
Not to mention: The number of sysadmins who rely on (whether by choice or corporate policy) Debian for their server installations is always high, and your cloud images[4] still ship a vulnerable APT. Isn't it also the case that, if a mirror *itself* is compromised or simply outright malicious, HTTPS alone doesn't mitigate this issue? Isn't it most trivial of all for a mirror itself to force retries of failed downloads, thereby totally bypassing PGP signature verification of packages? US citizens, and, more broadly speaking, citizens of the 5EYES, should be incredibly concerned by this given Debian's governing jurisdiction. The default GeoIP mirrors for new installations of Debian are, themselves, a threat to US users of Debian at installation time at present. And why the hell is it that I can find zero mitigation instructions published by Debian for the APT vuln? The advice from Debian seems to more or less just be "Upgrade as usual. Nothing to see here! See? We secured your operating system for you!" That, of course, is imbecilic advice—admittedly given only by implication of your silence on this matter, but the silence is truly deafening in this case. Ubuntu's blog actually provides the necessary steps to mitigate the vuln at time of package upgrades. Why did I need to check a derivative distribution's blog to find this? Your blog and microblog don't even mention the vulnerability at all. The mailing list thread documenting the upgrade to apt doesn't even document the steps to mitigate the vuln when upgrading apt itself! Why was there no new ISO released following the cert compromise? Why is there still no installation media now, following the fix of this critical APT vuln? It's not just you, either. Ubuntu's just as bad! Are you both completely compromised by glowies at this point?? Unkind regards, Elven Inquisition [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c5 [2]: https://ubuntu.com/blog/apt-vulnerability-fixes-available [3]: https://security-tracker.debian.org/tracker/CVE-2026-109518 [4]: https://cloud.debian.org/images/cloud/trixie/ --------------------------------------------- >Mercy let be off; damn them who pity! Kill and torture; spare not; be upon >them! — Liber AL III:18
