alt Hacker News> Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification
from the OP
APT can use HTTPS, but often doesn't, making a MITM attack easier (also the idea for a long time has been signatures are enough, and/or TLS certs used to be a lot harder to get, but at this point you should really be using both).
Replies
thayne • today at 5:45 PM
Https doesn't help with this if the MitM is the apt mirror you are using.
One reason http is still used is because you need an independent signature anyway since it is common to use mirrors that don't have the same level of trust as the debian maintainers
Still doesn't make sense to me. So package A is downloaded, signature verified, then package B is downloaded, but somehow the package A file is replaced? Is it something like that?