“Unfortunately, apt fetches packages over plain, in the clear HTTP, not HTTPS. And that's something I've complained about to Debian devs before. And I got poo-poohed because they're like, well, we do signature checking, so it doesn't matter. And this bug is an example of why it really does matter… the avenue that we do leave open if we use HTTP transport instead of HTTPS is attackers can still monkey with the actual communication channel itself.”

Yeah, unfortunately, apt fetches packages over plain in the clear HTTP, not HTTPS. And that's actually something that I've complained about to Debian devs before. And I got poo-pooed because they're like, well, we do signature checking, so it doesn't matter. And this bug is an example of why it really does matter. Because, okay, sure, you can check the package against a key, although I'm also a little upset that you download the key over plain text HTTP as well. But, you know, if we say, well, all right, we're sure that the system is going to only be trying to use the right key to blah, blah, blah. All right, whatever. But the avenue that we do leave open if we use HTTP transport instead of HTTPS is attackers can still monkey with the actual communication channel itself. And that's what happened in this case. You know, when you man in the middle the HTTP stream, you can try to target hard links on the system in ways that the package manager really wasn't expecting. And you can potentially run code that you really didn't want to run as root as a result of this. If the wrong attacker gets man in the middle on an unpatched version, havoc can ensue.