Missing ISO hash

2014-07-14 Thread Djones Boni
The Debian 7.6 update ISO hashes are missing on bt-dvd directory. http://cdimage.debian.org/debian-cd/7.6.0/amd64/bt-dvd/MD5SUMS http://cdimage.debian.org/debian-cd/7.6.0/*/bt-dvd/MD5SUMS They can be found in iso-dvd and jigdo-dvd. http://cdimage.debian.org/debian-cd/7.6.0/amd64/iso-dvd/MD5SUMS

Re: SSL for debian.org/security?

2013-10-30 Thread Djones Boni
On 30-10-2013 09:51, Celejar wrote: Maybe I'm missing something, but the security of the apt system has nothing to do with SSL - it uses GPG signatures. This discussion about SSL concerns the website, etc. The point is server authentication. Without SSL anyone can simply hack DNS or MITM and

Re: SSL for debian.org/security?

2013-10-30 Thread Djones Boni
On 30-10-2013 11:05, Celejar wrote: You're snipping crucial context; my comment above was in response to this: For apt-get a self-signed certificate could be used which comes together with Debian. No CA required. This is both simpler and safer. I was pointing out that this comment makes no

Re: SSL for debian.org/security?

2013-10-29 Thread Djones Boni
On 29-10-2013 07:29, Nikolay Kubarelov wrote: I would use Tor hidden service instead of SSL. Tor is too slow and you must install additional software. A better idea is offer both SSL and a Tor Hidden Service. You choose which use. Do not forget Tor encryption is not considered secure anymore.

Re: SSL for debian.org/security?

2013-10-29 Thread Djones Boni
On 29-10-2013 08:36, burgers@gmail.com wrote: Its not tor itself that was compromised but the version of Firefox bundled with the Tor browser bundle. They used a 0day to install a tracking cookie in FF. The FF bug exploited by Freedom Hosting script was not a 0day one. There was a updated

Re: SSL for debian.org/security?

2013-10-29 Thread Djones Boni
On 29-10-2013 09:56, Celejar wrote: The OP was asking for authentication, not encryption. Celejar Tor HS addresses are self authenticating (80 bits of entropy). It is possible (and very hard) to create an alias but it is much better than clear text over http. On 29-10-2013 09:53, adrelanos

Re: SSL for debian.org/security?

2013-10-29 Thread Djones Boni
On 29-10-2013 10:49, Celejar wrote: The question is not whether it's better than clear text over HTTP, but whether it's better than SSL. *If no CA is compromized*, I think SSL alone is more secure than Tor alone. But it is possible to use SSL with Tor. Then there are two layers of