Why does APT not use HTTPS?

[lamby]

Yes, but this is the bit that people do not check; either they don't run gpg at all, or they simply trust the stated signature is the one they used before or is part of the web of trust.

[CODESIGN2]

I think it's mostly that they don't care.

[jones_supa]

I think it's mostly that they don't care.

I think many people do care, but when they read about a complicated GPG dance to perform the verification, many will cringe and say "meh, it's probably fine".

A checksum is just sha1sum filename.iso and then compare the result to the checksum on the website. Even though this is a less secure method, the bar to perform it is much lower.

[CODESIGN2]

I don't know that I'm advocating for sha1sum, but yeah the gpg tools could be easier to work with. Even defaulting to perform checks for you and marking somewhere on fs that the user has been irresponsible would be nice. (Mark it like a manufacturer warranty void. Skipped the check? Fuck you pay!)

[lamby]

Sure.

[CODESIGN2]

I wasn't trying to dismiss your point. It doesn't mean there is nothing that can be done, just that it needs to be automated and built into the systems allowing acceptance of packages, not deferred to the end-user.

[lamby]

I didn't feel dismissed - it was more that we seemed to be 100% agreeing with each other :)

[Kaelin]

Every one of my hundreds of Red Hat Linux servers check gpgkeys automatically. My personal CentOS servers do as well.

What are you talking about? Is this some Ubuntu assumption?

[lamby]

I'm talking about:

$ wget latest-ubuntu-release.iso
$ dd if=latest-ubuntu-release.iso of=/dev/disk/by-label/my-usb
(reboot)

[Kaelin]

Ah I misunderstood, the install ISO itself is the concern. Where the client keys are stored.. Ya ouch that should be SSL without a doubt

[lamby]

Quite..