Hacker News Reader

Comment by icebraining | Hacker News Reader

I don't disagree that SSL/TLS doesn't add much security (though it does provide privacy regarding the packages being pulled), but don't conflate it with the CA system; they could just as easily pin the SSL/TLS cert at install.

View on HN

Fair point, but this would still be less secure. Packages are generally signed by individual maintainers and as maintainers come and go, the trusted keyring evolves. It also puts the power of signing packages directly into the hands of maintainers, rather than granting access to a single all-powerful private key.

I don't think anyone is arguing that you should replace PGP signing with HTTPS.

I don't think that anyone is arguing that, either. I'm saying adding HTTPS isn't an improvement.

And yet the existence of this exploit, which would have been prevented with HTTPS as I understand, counterproves your point. There's a reason security engineers advocate for defense in depth; even if one system fails you have a higher likelihood of preventing any issue or perhaps at least mitigating the scope/severity because other systems are still there. Self-signed HTTPS certs seems about as safe & secure as self-signed PGP packages so how can having both in any way reduce the overall security.

"The existence of an exploit" will undermine literally any system and you can't meaningfully use that argument.

"The existence of an exploit" is an argument in favor of defense-in-depth techniques, as an exploit in one layer does not result in full-system compromise.

I would again add that preventing a connection from forming, preventing protocol, buffer, filesystem, and timing attacks as well as preventing a malicious payload from ever reaching disk, is itself a great improvement. Also it carries the guarantee that once the transport is finished the contents are ready to be trusted rather than the transport -> validate -> trust model using PGP signatures.

For maximum security and user experience I'd say both though - validate you are connecting to who you think you are and also validate the PGP signature. For how often packages are installed vs how high of a risk remote code poses to the system I think it's a bit foolish to say we can only do one and when we do we are perfect.

This is less easy if you have mirrors.

Reply on news.ycombinator.com