[Sent direct -Copied to list because neither monodev nor Elven Inquistion may be subscribed]
On Sun, Nov 08, 2026 at 06:50:14PM +0300, monodev wrote: > On 11/8/26 10:48 AM, [email protected] wrote: > > On Sat, Nov 07, 2026 at 08:05:54PM +0000, Elven Inquisition wrote: > > > > [...] > > > >> Such a tragically predictable response… > > > > I'm a bit uncomfortable [1] with your tone. Debian is a volunteer > > project. You talk in a tone of entitlement that doesn't match that. > The tone is indeed self-defeating but this is a valid concern. > > If my understanding is correct all new Debian installs from November 4 > to November 21, and any installs using outdated images after November > 21, will be trivially vulnerable to MITM attacks. > I think your understanding may be incorrect here. If you boot using a current 13.7 netinst image and use the standard mirrors / the deb.debian.org stanzas, then the new apt will be installed as part of the initial bootstrapping. By the time you've got a user added and reboot - you've got the new apt. That goes for every install, obviously. The fixes were published on November 4th. If you don't connect your machine to a network *at all* and use a DVD or larger image to install all of your software on the machine - that might be vulnerable if it is from current media but that is a minor use case. If you don't connect your machine to a network and maintain it as air-gapped, then you'll presumably just update it from media periodically. The next point release is scheduled in under 14 days and will incorporate all security fixes to the point of freeze prior to release at that point. *That* release will have the fixed apt > I agree that it'd be prudent for Debian developers to address this issue > as soon as possible, although obviously none of us are in a position to > demand this work from them, and I remain as thankful as ever for their > effort. > Already done: see above. Debian and Ubuntu fixes were published earlier this week in a timely manner. > - monodev > With every good wish to the readers of this list, as ever, Andrew Cater ([email protected])
