Re: thoughts on blocking and downgrade attacks agains secure APT

2012-03-20 Thread David Kalnischkies
On Mon, Mar 19, 2012 at 02:33, Christoph Anton Mitterer wrote: > - Is APT (apt-get) using it in all places, i.e. not just apt-get > upgrade/install/update but also source? Indexes are only downloaded with 'apt-get update' - front-ends usually use either this directly or the code in the libapt lib

Re: thoughts on blocking and downgrade attacks agains secure APT

2012-03-19 Thread Chris Knadle
On Sunday, March 18, 2012 21:33:05, Christoph Anton Mitterer wrote: > Hi. > > I recently played with Nagios' check_apt script (more on that later) and > this brought my attention to the following issues. > > > As everyone knows, our packages/archives are in principle fully secured > ("secure APT

Re: thoughts on blocking and downgrade attacks agains secure APT

2012-03-18 Thread Christoph Anton Mitterer
(sorry for the double posting,.. my MUA crashed in between) One addition immediately which is however not directly related to the discussion. I stumbled across those issues when I spent some thoughts on the check_apt test from Nagios. I wanted a fully secure way to be notified when updates are

thoughts on blocking and downgrade attacks agains secure APT

2012-03-18 Thread Christoph Anton Mitterer
Hi. I recently played with Nagios' check_apt script (more on that later) and this brought my attention to the following issues. As everyone knows, our packages/archives are in principle fully secured ("secure APT")... via signed Release files and hashsums on the other files. I personally have s