Andrew M.A. Cater wrote: >You do realise that your network install from any existing .iso file >will do the updates immediately before you even have the first reboot? >That the security updates are published regularly and unattended-upgrade will >do any updates for you pretty much immediately?
I always perform an offline installation, but it doesn't shock me to hear that that's the case. While that eliminates the coffee shop skid attack vector for those performing a network installation, it of course makes a hostile mirror or ISP a far more immediate threat. >if you *really* want new .iso images, you can wait for approximately >two weeks from now and 13.8 software and images hsould be released >on November 21st. Such a tragically predictable response… >I'll be part of the usual point release team so checking images on that >day. I appreciate your work for the cause of free software, and I appreciate that you took the time to reply so candidly. The answers provided are unfortunate, but they're certainly better than no answer at all. I hope those with unattended-upgrades disabled at least took note of the mitigation steps provided by Ubuntu, which I linked to in my initial email. It was incredibly disappointing that Debian didn't at least provide a link to that guide, or even mention the vuln on its blog. I can certainly understand not having written your own guide on the topic, especially given the primarily unpaid volunteer basis of the project. But the total silence on the issue via typical Debian news channels was, as I noted, deafening. Kind regards, Elven Inquisition
