Hacker News Reader

Comment by maxt | Hacker News Reader

Interesting that the site uses TLS, but most of the servers containing the download use plain old HTTP, which as we know, can be easily subjected to a MITM attack.

https://linuxmint.com/edition.php?id=225

Only a few of the ISOs are delivered with TLS/HTTPS, like this one:

https://mirrors.c0urier.net/linux/linuxmint/iso/stable/18.1/...

View on HN

Properly signed images shouldn't need to be delivered over a secure connection. As long as you can receive a signed hash, and the signing key itself over a secure connection, you can obtain the image itself from anywhere.

and the signed hash is actually checked against the image. Of course, this is the step that is missing because it's a non-mandatory manual process.

Serving the images directly over HTTPS would provide more security for every end user that is not manually checking signing hashes.

True, although sometimes it's good to deliver signed updates over a secure connection for defense-in-depth - for example, to mitigate vulnerabilities like the recent CVE-2016-1252.

+1 "but some software has it's own crypto"¹ is kinda bad excuse for actively avoiding additional security - like Debian has on their mirrors (I think there even is (was?) an FAQ entry why there are no HTTPS mirrors, stating that APT packages are securely signed and that's all you'd need).

¹ I'm aware that APT actually uses GPG, but it does (did) so fishy manipulations both before and after invoking GPG on the signed files, that, if this would've happened in a corporate setting, I'd have rather peculiar questions for the employee who wrote that code.

That recent CVE, and also issues in software that I co-maintain, plus all the other CVEs that are delivered to my inbox changed my mind on open source quite a lot. Open source is completely worthless if no one actually bothers to read the code; I doubt anyone actually read those portions of the APT code, because anyone with a secure coding or crypto coding background should be alerted already by the function names (look them up). Instead we all always assume "ah well people use it and someone probably checked that anyway... should be good to go!". NO. It's not good to go. Read [the] code.

> ¹ I'm aware that APT actually uses GPG, but it does (did) so fishy manipulations both before and after invoking GPG on the signed files, that, if this would've happened in a corporate setting, I'd have rather peculiar questions for the employee who wrote that code.

From the openSUSE, I brought up my concerns about us not using HTTPS and it boils down to the fact that few mirrors want to host stuff over SSL. And if not many mirrors will do it, the benefit to users is diminished (you can't force the usage of SSL on the client).

On the plus side, openSUSE does serve a copy of the GPG signing key for the ISO over HTTPS (from the main site). I just wish that there were less steps required to be sure that the ISO is official.

Reply on news.ycombinator.com