Ubuntu 23.04 & 22.04.3 Installs Haven't Been Following Their Own Security Best Practices

[phoronix]

Phoronix: Ubuntu 23.04 & 22.04.3 Installs Haven't Been Following Their Own Security Best Practices

It turns out that Ubuntu Linux installations of Ubuntu 23.04, 23.04.3 LTS, and installs done since April 2023 that accepted the Snap version update haven't been following Ubuntu's own recommended security best practices for their security pocket configuration for packages. A new Subiquity release was issued today to fix this problem while those on affected Ubuntu installs are recommended to manually edit their /etc/apt/sources.list file...

https://www.phoronix.com/news/Ubuntu-Security-Pocket-Issue

[RahulSundaram]

Headlines makes it sound much worse than it really is. This is a pretty small config change that unlikely has any material impact on users. Mirrors for distros rarely if ever lag behind the primary and major distros have tools to check and drop out lagging mirrors from the list automatically.

[peterdk]

Hmm, my home server on 22.04LTS indeed has a mirror for those. Changed it now.

Benefit of the mirror however is that download speeds are much larger. When something like linux-firmware updates, you get very low speeds for a 250MB file download...

[andre30correia]

i always use main server but is not a big problem in my point of view

[Bamber]

Typo:

23.04.3 LTS

[JEBjames]

Michael

Typo

"Tis bug was marked as of" should be "This bug was marked as of"

[paleo-tech]

If they were really concerned about security shouldn't all the URLs be https and not http?

[drake23]

If they were really concerned about security shouldn't all the URLs be https and not http?

No, because packages are signed

[Antennae5101]

No, because packages are signed

"Packages are signed" - insufficient and dangerous argument, as extensively talked upon on this eight year old bug where Canonical is urged to use HTTPS for all apt traffic - https://bugs.launchpad.net/ubuntu/+bug/1464064

Safer is to use an HTTPS mirror for both normal and security repositories than Canonical's own.

[F.Ultra]

"Packages are signed" - insufficient and dangerous argument, as extensively talked upon on this eight year old bug where Canonical is urged to use HTTPS for all apt traffic - https://bugs.launchpad.net/ubuntu/+bug/1464064

Safer is to use an HTTPS mirror for both normal and security repositories than Canonical's own.

yes and none of them are really valid as was also pointed out in that bug. The signing of the packages and of the meta data is much stronger than what TLS provides and can also not be man-in-the-middled with a fake CA like TLS can. Ofc this is not to say that layers doesn't have meaning, just that http in this particular case is not insufficient nor dangerous.