Re: CVE for Kali Linux

[Alexander Cherepanov <ch3root () openwall com>]

On 2015-03-22 20:23, Solar Designer wrote:
> https does offer a security aspect that signatures don't: it hides from
> some observers which exact software is being downloaded (and maybe that
> it's a software download at all).  It doesn't do that perfectly because
> the target address and transfer timings and sizes may be revealing, but
> I do acknowledge there's some subtle improvement over http here.  I just
> think this is far less important than ensuring authenticity of the
> software.  So let's demand signatures and signature verification first,
> and let's not be distracted by http vs. https.

There are some attacks even if you verify signatures, e.g. serving old, 
known-vulnerable versions. HTTPS can help here (until signatures start 
to be widely accompanied by expiring timestamps or something).

--
Alexander Cherepanov