Hi, On Sun, Nov 08, 2026 at 04:22:55PM +0000, Andrew M.A. Cater wrote: > [Sent direct -Copied to list because neither monodev nor Elven Inquistion > may be subscribed]
Tangent: is the LDO_SUBSCRIBER spamassassin tag still useful for this? I've glanced at headers on a few list messages recently and seen it isn't there more times than I expected. Should we be making an effort to cc: people unless we know otherwise? > On Sun, Nov 08, 2026 at 06:50:14PM +0300, monodev wrote: > > If my understanding is correct all new Debian installs from November 4 > > to November 21, and any installs using outdated images after November > > 21, will be trivially vulnerable to MITM attacks. > > I think your understanding may be incorrect here. If you boot using > a current 13.7 netinst image and use the standard mirrors / the deb.debian.org > stanzas, then the new apt will be installed as part of the initial > bootstrapping. By the time you've got a user added and reboot - you've > got the new apt. Doesn't that initial stage of using oonly the udebs that come on the netinstall use a cert bundle that still includes eMudhra though? So the entire initial download could in theory come froma fake deb.debian.org stodd up locally by a malicious network admin who also meddled with your resolver such that deb.debian.org points at their fake host, for you. Though even if that is the case I do not agree that is "trivial". The generation of a fake TLS cert is trivial; the fabrication of a hostile deb.debian.org seems less so given that it would still have to include InRelease files etc signed by Debian's GPG key. Doesn't it just get you a mirror that the installer rejects as having broken packages / indexes? Thanks, Andy -- https://bitfolk.com/ -- No-nonsense VPS hosting
