On 07/11/2026 10:23, Elven Inquisition wrote:
Debian Developers:
Given how trivial it is to crack eMudhra's certs[1], isn't HTTPS useless as a
mitigation[2] for CVE-2026-109518[3] wrt new installations? It's bad enough
Yes, I believe so. That's why most installations of apt still use
http:// URLs. HTTPS only guarantees that the file you receive is the
file that was on the server. It doesn't guarantee that the packages were
built by Debian or that they weren't tampered with on the server. Apt
itself verifies the contents of the package using several cryptographic
quality checksums *and* size (which prevents certain padding attacks)
*and* verifies a GPG signature.
It's true that HTTP allows a man in the middle to substitute files as
they're being downloaded, and it's true that HTTPS is designed to
prevent that *and* it's true that the eMudhra compromise makes HTTPS
little better than HTTP (not quite, but there's a possibility to bypass
the safeguards of HTTPS). However, a man in the middle still needs to
overcome a LOT of hurdles. The malicious package needs to exactly match
the checksums of the index file. And the index needs to have been signed
by a GPG key that the user trusts. Downloading the packages and the
indexes in plaintext doesn't really give attackers much leverage, does it?
