Re: Pre-approval for apt 0.7.21: "Valid-Until" feature and proxy changes
* Moritz Muehlenhoff:
>> And there is also the option of including it in the first point release,
>> after a month or two of testing in unstable.
>
> Since the replay attack isn't exactly grave, it could just as well be added
> into 5.0.1 oder 5.0.2 once it has gotten some testing.
And if Valid-Until is only checked against the real-time clock, the
attacker can still feed bad data over NTP, so it's not even a complete
defense. 8-(
Reply to: