Hacker News Reader

Comment by ben_w | Hacker News Reader

I’ve been around long enough to remember when people thought that sort of thing was a particular flaw of closed-source, but Ubuntu is failing in a similar way, as this unfixed bug from 2014 (confirmed and with multiple duplicates) demonstrates: https://bugs.launchpad.net/ubuntu/+bug/1359836

Call me cynical, but this is what I expect to see if a government had ordered them to allow certain forms of interference with the OS. I don’t know enough to eliminate any other possibility, but it certainly smells fishy.

View on HN

Wait, am I reading this bug correctly: even if I have HTTPS everywhere installed to force the S in errant urls, it would still go over HTTP? Because... "we provide the signatures"? Yikes.

No you are not. the "bug" is that the download page has a link to an http mirror.

If there was a bug where the ubuntu website could force your browser to display https:// and serve content over http without a warning you would have most definitely heard about it before now.

As to why most mirrors serve over http, it's for the same reasons presented here: https://whydoesaptnotusehttps.com/

Is there any clear reason why the checksums are also only available on http domains? One of the duplicate bugs: https://bugs.launchpad.net/ubuntu-website-content/+bug/15349...

I believe your link does not explain why Ubuntu’s .iso files are not on https, as one of its justifications is that APT uses other mechanisms for integrity checking, which doesn’t apply to OS installation disk images.

I agree with parent, it doesn't make sense to host checksums on a plain HTTP site.

Also grandparent's link states

>HTTPS does not provide meaningful privacy for obtaining packages. As an eavesdropper can usually see which hosts you are contacting

Which is untrue. An attacker can't tell which specific packages are being downloaded, which could be important depending on your threat model.

(The argument can be made size of DL leaks info, but that's a lot of work, and multiple packages could have same size)

Reply on news.ycombinator.com