HN

Comments (27)

• Menu

  justicz
  I found this! I posted a semi-click-bait-ey tweet about it here [0], I think it’s important for people know how easy these bugs are to find now. It’s becoming borderline irresponsible not to audit your internet-facing code with modern AI tools.[0] https://x.com/just1cz/status/2118009777922228361
• getcrunk
  It always bothered me that apt didn’t use encryption, I know the issue here doesn’t boils down to that, but damn this sucks.Sure I can update, but how to check I want compromised? Will apt check the state of past/installed updates?
• xeyownt
  We are living in times where I read first in HN what apticron is going to send me by mail.
• linsomniac
  For those of you not familiar, apt-cacher-ultra is fairly new (~9 months old), and it can reduce your exposure to this. It uses a completely different mechanism for verifying signatures, and does validate signatures, so if your apt clients grab the packages from the cache, it shouldn't be open to this bug.The next version is going to include TLS and ACME support for the client->cache connection.https://github.com/linsomniac/apt-cacher-ultra
• hollow-moe
  But how do I update apt if apt is untrustable until fixed ? Good ol' .deb scp'd in dpkg'd.
• thewisenerd
  dupe (2h ago): https://news.ycombinator.com/item?id=50364814
• Menu

  8organicbits
  I feel like they should release manual update instructions since the update mechanism is vulnerable. Although I see my systems already updated via unattended upgrades.edit: On lobste.rs I see a recommendation for `apt download`: https://lobste.rs/s/h7bvma/man_middle_arbitrary_code_executi...
• Menu

  SoftTalker
  How would an attacker inject a redirect into an apt package download?
• anon
  undefined
• ChrisArchitect
  Discussion here: https://news.ycombinator.com/item?id=50364814
• kitehosting
  [flagged]
• sick_of_slop
  [dead]
• Menu

  opengrass
  [flagged]