Trouble at Linux Mint — and beyond [LWN.net]

Trouble at Linux Mint — and beyond

Posted Feb 25, 2016 13:24 UTC (Thu) by gnu (guest, #65)
Parent article: Trouble at Linux Mint — and beyond

I think the users should be educated to verify whatever they download. Package managers make the task of verifying packages easy. But users should also verify the downloaded ISOs. Debian shows us the way by signing the ISOs with the GPG key and has a page on how to verify:

https://www.debian.org/CD/verify

to post comments

Trouble at Linux Mint — and beyond

Posted Feb 25, 2016 13:33 UTC (Thu) by gnu (guest, #65) [Link] (7 responses)

.. and it appears that they had the gpg signatures published as well. Doh! So, it is a question of "usability" of the verification then!

https://mirrors.kernel.org/linuxmint/stable/17.3/

Trouble at Linux Mint — and beyond

Posted Feb 25, 2016 13:55 UTC (Thu) by gnu (guest, #65) [Link] (4 responses)

.. and for the reference, the Tor project has a great link explaining how to verify the signatures.

https://www.torproject.org/docs/verifying-signatures.html.en

Trouble at Linux Mint — and beyond

Posted Feb 25, 2016 22:48 UTC (Thu) by giraffedata (guest, #1954) [Link] (3 responses)

And those instructions are far too complex to expect more than a few people to do it. The problem of hijacked web pages would have to get a lot worse than it is before users would find that worthwhile.

Could the web browser take care of all this? It already has a web of trust for use in authenticating websites; how hard would it be for the web browser to validate a signed checksum and check the checksum when it downloads a file?

Trouble at Linux Mint — and beyond

Posted Feb 25, 2016 22:55 UTC (Thu) by pizza (subscriber, #46) [Link] (1 responses)

> Could the web browser take care of all this? It already has a web of trust for use in authenticating websites; how hard would it be for the web browser to validate a signed checksum and check the checksum when it downloads a file?

....This ends up devolving into a PKI problem..

(The signature could also be compromised, as could the public key used to check the signature, as could the fingerprint of the public key, and so forth...)

Trouble at Linux Mint — and beyond

Posted Feb 26, 2016 0:05 UTC (Fri) by giraffedata (guest, #1954) [Link]

Is it a bigger PKI problem than with web browsers authenticating websites or with users manually verifying signatures per the referenced instructions?

Trouble at Linux Mint — and beyond

Posted Feb 27, 2016 0:01 UTC (Sat) by mcatanzaro (subscriber, #93033) [Link]

Kind of, the tech is mostly in place, it's just not widely used yet. If you use HSTS on your server (no excuse for not doing so, but few sites do), and your users use a browser that checks certificate transparency logs (Chrome only right now, Firefox is working on it last I heard), and you have some automated notification when rogue certs for your domain appear in the log (I haven't heard anything about this, it's probably the missing link), then there's no way this could happen (unless the user has never visited your site before, or not for such a long time as for the HSTS policy to expire).

I expect most of the above will be widely deployed in the next five years or so, and we'll all be safer for it. In the meantime....

Trouble at Linux Mint — and beyond

Posted Feb 25, 2016 13:58 UTC (Thu) by jospoortvliet (guest, #33164) [Link] (1 responses)

Sadly, if the shipped software is full of known and well described security holes, verifying the packages isn't going to help you much... This is where the blog linked in the article comes in.

The problem is not on the users' side but, imho, on the distribution and upstream's collaboration problems. There are too many distributions and collaboration with most of them is too hard (tools, policies etc) to make it feasible for upstream to collaborate. The likes of Wordpress don't even try - tell their user to use zip files. We've decided to do the same, seeing how important fixes didn't make it to users, though we still also build packages and are still looking for a better solution.

Thing is, I think that it would be good to have distributions ship end user software, rather than forcing users to get it directly from upstream. The model is, in principle, better, imho. But then, the software needs to be up to date and secure - it frequently isn't, at least in so called 'stable' distributions, as of today. The model is probably OK for non-web-facing software written in C or C++ but with web apps written in PHP, Perl, Go and friends, all with their often crazy needs - it seems hard to get it right.

Trouble at Linux Mint — and beyond

Posted Feb 27, 2016 0:04 UTC (Sat) by mcatanzaro (subscriber, #93033) [Link]

Penny for your thoughts on https://lists.fedoraproject.org/archives/list/devel@lists...