2

It is always verify disk images before using.

In Ubuntu's website, many pages are sent through https. However, some of the most crucial pages are not. For example, http://releases.ubuntu.com/trusty/.

This is clearly vulnerable to mitm and tons of other attacks. Although most of them are debunked, there has been lots of myth of backdoors in Ubuntu. I fear that this is a sign of government bugging the image files, or backdooring the software.

Is there any reason for Canonical/Ubuntu site maintainers to disable https at none but the checksums pages?

|improve this question
  • 1
    HTTPS is in most cases slower, so they probably wanted to make the downloads faster. If an attacker decieved you to download something else, the checksums would not match (and the cheacksums are secure). – Vilican Mar 19 '16 at 21:02
  • @Vilican - The page referenced doesn't have instructions for how to validate the checksums. Even if it did, as the page isn't using SSL, they could be changed. So, while the checksums may be secure, the page could be modified in transit to have different checksums and describe an entirely different checksum validation process. – Neil Smithline Mar 20 '16 at 3:49
3

Ubuntu images are available from lots of mirrors which are out of control of Canonical. That means you cannot trust the image itself because it might be that one mirror is compromised and is distributing modified files. That's why Canonical offers signed checksum files like SHA256SUMS.gpg which are cryptographically signed so you can verify that the image is actually the one released by Canonical.

Nevertheless would it be of course much nicer if they provide their own mirrors with https and if they also provide detailed instructions how the download should be verified, instead of just downloading the image without any kind of obvious validation.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.