First screen, captured 9 days ago. Open the video.

Debian apt security update: man-in-the-middle arbitrary code execution

What HN thinks

The decade-old 'signatures are enough, who needs HTTPS' debate returns, now with a CVE attached and a German compound word for the fix.

apt should default to HTTPS
Many argue this bug proves plain HTTP exposes too much attack surface and leaks which packages you install, so TLS should be the default.
Signatures model is sound, implementation wasn't
Others say treating transport as untrusted is correct; the real flaw is validating before the final file is settled, and HTTPS adds its own problems like clock-less devices and compromised mirrors.
Speculation on mechanics and severity
Commenters guess redirects cause two downloads to share a URI so a verified file gets overwritten, and debate CVSS scoring for MITM scenarios.

Consensus: Most agree the bug is a verification-ordering flaw made reachable by plain HTTP, and that adding TLS on top of signatures would be prudent defence in depth.

Recommended in the comments

apt-transport-https (library): Lets users switch mirror URLs to HTTPS to avoid MITM exposure.

Summarised by Claude from the comment thread 9 days ago.

Points: 50
Comments: 52
Best rank: #9
Posted: 2026-11-04 by vesinisa
Category: Security

debian apt cve man-in-the-middle package-manager security-advisory linux

All captures:

Full page

Captured 9 days ago. Click for the whole screenshot.

Looks similar

Screenshot of lists.debian.org: Debian apt security update (man-in-the-middle)

Debian apt security update (man-in-the-middle)(lists.debian.org)

118 points by SG- 9 days ago | 25 comments

Debian Security Advisory DSA-6607-1 announcing an apt update fixing a man-in-the-middle flaw allowing package replacement and root code execution.

debian apt package-manager man-in-the-middle

Screenshot of pigshell.com: Pigshell: Unix the Web

Pigshell: Unix the Web (pigshell.com)

63 points by pbohun 4 days ago | 18 comments

Pigshell 0.6.4 is a browser-based Unix-style shell that represents web resources and cloud data as files you can process with command pipelines.

pigshell unix-shell javascript browser-shell

Screenshot of delorie.com: The History of Djgpp (1998)

The History of Djgpp (1998)(delorie.com)

59 points by atan2 10 days ago | 23 comments

DJ Delorie's 1998 history of DJGPP, the port of GCC to MS-DOS, covering its origins, the go32 extender, and releases through version 2.02.

djgpp gcc ms-dos dos-extender

Screenshot of postgresql.org: PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 Released

PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 Released (postgresql.org)

57 points by plaur782 1 day ago | 6 comments

PostgreSQL release announcement for 18.7, 17.12, 16.16, 15.20, 14.25 and 19 RC 2, fixing 52 security vulnerabilities and 140+ bugs, and marking PostgreSQL 14 end-of-life.

postgresql security-release cve database

Screenshot of wadetregaskis.com: macOS 27 does not support CoreStorage volumes

macOS 27 does not support CoreStorage volumes (wadetregaskis.com)

113 points by colejohnson66 10 days ago | 94 comments

Blog post describing how macOS 27 Golden Gate fails to mount, convert, or erase CoreStorage encrypted HFS+ volumes, with debugging details and a workaround.

macos corestorage hfs-plus apfs

Screenshot of neil.fraser.name: .name Grandfathered

.name Grandfathered (neil.fraser.name)

902 points by p4bl0 3 days ago | 196 comments

Neil Fraser's blog post announcing Verisign retracted its plan to terminate 22,000 .name domains and email redirects, grandfathering existing registrations.

dot-name domain-names verisign icann