1

I recently searched on the web to know about https for apt-get and as far as I read there's no actual need, that at least is what a lot of people defend, for the use of it for this as it's always automatically checked for integrity, is this right? Did I got it right? Also, being that so, in the case of deciding to USE the https through the configuration of a server that supports it, the only possible downside would be speed is that right?

And finally but not least, I guess that any *buntu distros depend on the same estabilished rules for this subject am I right? (that's, everything is gonna be checked for integrity) Because as far as I know they all use ubuntu servers right?

Thanks a lot, I know there are some questions integrated, but if you can clarify that all to me and to the community for people that may possibly be looking for the same kind of information I do appreciate a lot :)

2 Answers 2

0

Many distros use a third-party mirror network, with packages hosted on essentially untrusted servers run by various organizations and individuals, which means any mirror's operator can, technically, replace any file they want. Transport encryption (TLS) cannot protect against that; only package signing does. The package lists and individual packages are usually signed using PGP.

That said, some distributions' mirrors are slowly moving towards HTTPS for various reasons, including (some) privacy protection. For example, the Arch Linux mirrorlist has 26 HTTPS servers (which is 10% out of 261), which is already more than the 0% it had in 2012.

Debian, however, doesn't seem to support HTTPS at all – which is odd, since AFAIK they both recently moved to a centrally-managed CDN structure and could deploy HTTPS configuration everywhere at once. You can use HTTPS for some third-party repos though, but you'll need to install apt-transport-https first.

7
  • My guess is that encryption should at least be a choice for everyone, I know this costs money and I believe that anyone that has a real good opportunity and can help the projects in the possible means should do so if that's right for the person. I didn't know about the centrally-managed CDN though... Yes, I read that apt-transport-https is an option. But anyway, you @grawity or someone can explain better how does this GPG signature with APT works?
    – user512585
    Oct 22, 2015 at 5:34
  • It costs time – signing up for StartSSL or waiting for LetsEncrypt; setting up the web server for HTTPS; etc. – it doesn't really cost money. Oct 22, 2015 at 5:40
  • I see, If possible I'll research more about StartSSL and LetsEncrypt. But I do get that free software like linux happens because of the community. But should we trust these companies offering free encryption? Again, if possible I'll reasearch more, but that's one of the first thoughts that comes to my mind.
    – user512585
    Oct 22, 2015 at 5:50
  • And thanks for your help @grawity, I'll ask for the GPG information, but just to clarify, I am not searching now for how the whole GPG functions, I want to understand how it's used with the APT. For example, is there some sort of database on a distro that makes it possible for all the keys to be in the distro and then just checked out against what is provided from a repo?
    – user512585
    Oct 22, 2015 at 5:56
0

A number of third party repositories aren't HTTP. Packages are already verified against a public GPG key.

However after the NSA revelations and repeated security failures - encryption everywhere is becoming best practice.

Would the list of packages you install be useful to the NSA or criminals? The NSA is already targeting "tor" users - do you really want all your communications monitored because you downloaded "tor" from a repo? Or have the FBI bust down your door because you downloaded "bittorrent" from a repo?

4
  • Yes, I agree that encryption everywhere is the best practice, even though NSA has been able to crack normal encrypted communications already, it's more difficult though of course, depending on several situations. But the last part of your answer sounded a little bit ambiguous to me @teambob I mean are you saying we should use encryption to avoid that or that it would be silly to do what you want and is your right? Because for me it's our right to use tor if we want for example, we just have to be honest and civilized of course.But no one should "target" tor users just because they're tor users
    – user512585
    Oct 22, 2015 at 5:24
  • Oh, and I appreciate your answer @teambob :)
    – user512585
    Oct 22, 2015 at 13:15
  • It is already documented that the NSA targets tor users. So knowing if someone downloaded tor could be interesting information for the NSA. The FBI has a history of raids for copyright infringement. Will a download of bittorrent attract attention even if you don't use it for infringing copyright? This is not tin-foil-hat territory anymore unfortunately this is happening on a daily basis
    – teambob
    Oct 26, 2015 at 2:58
  • I agree with your perspective @teambob :)
    – user512585
    Dec 29, 2015 at 15:21