Re: CVE for Kali Linux

[Marcus Meissner <meissner () suse de>]

On Sun, Mar 22, 2015 at 11:34:28PM +0300, Alexander Cherepanov wrote:
> On 2015-03-22 20:23, Solar Designer wrote:
> > https does offer a security aspect that signatures don't: it hides from
> > some observers which exact software is being downloaded (and maybe that
> > it's a software download at all).  It doesn't do that perfectly because
> > the target address and transfer timings and sizes may be revealing, but
> > I do acknowledge there's some subtle improvement over http here.  I just
> > think this is far less important than ensuring authenticity of the
> > software.  So let's demand signatures and signature verification first,
> > and let's not be distracted by http vs. https.
>
> There are some attacks even if you verify signatures, e.g. serving
> old, known-vulnerable versions. HTTPS can help here (until
> signatures start to be widely accompanied by expiring timestamps or
> something).

SUSE has added an expiry tag in the YUM metadata for such cases.

Ciao, Marcus