Hi,On Thu, 19 May 2016 10:03:49 +0200 Julien Cristau <jcristau@debian.org> wrote:
On Sat, Aug 22, 2015 at 01:28:22 +0200, Raphael Geissert wrote: > Nowadays the Release files for the *stable releases do not have a > Valid-Until field. > >From a security POV, this could allow a replay attack to be performed > on the main stable repositories, which could prevent a user from > getting some security updates.> > Would it be possible to have such a valid-until field with a duration> of, say, four months? > Given the trend of doing point updates every few months, the date > could be renewed only at point release time.
I think it would have to be 6 months, at which point I don't see that it buys you much in the way of security, and it breaks archive.debian.org further. So I'm not wild about that idea.
So, shall be close (wontfix) this bug report? Or have insights changed in those 7 years in between?
Paul
Attachment:
OpenPGP_signature.asc
Description: OpenPGP digital signature