{"action":"created","issue":{"url":"https://api.github.com/repos/kata-containers/documentation/issues/286","repository_url":"https://api.github.com/repos/kata-containers/documentation","labels_url":"https://api.github.com/repos/kata-containers/documentation/issues/286/labels{/name}","comments_url":"https://api.github.com/repos/kata-containers/documentation/issues/286/comments","events_url":"https://api.github.com/repos/kata-containers/documentation/issues/286/events","html_url":"https://github.com/kata-containers/documentation/pull/286","id":374374458,"node_id":"MDExOlB1bGxSZXF1ZXN0MjI2MDkwNjMy","number":286,"title":"Use https instead of http in package installs","user":{"login":"ttx","id":712511,"node_id":"MDQ6VXNlcjcxMjUxMQ==","avatar_url":"https://avatars2.githubusercontent.com/u/712511?v=4","gravatar_id":"","url":"https://api.github.com/users/ttx","html_url":"https://github.com/ttx","followers_url":"https://api.github.com/users/ttx/followers","following_url":"https://api.github.com/users/ttx/following{/other_user}","gists_url":"https://api.github.com/users/ttx/gists{/gist_id}","starred_url":"https://api.github.com/users/ttx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ttx/subscriptions","organizations_url":"https://api.github.com/users/ttx/orgs","repos_url":"https://api.github.com/users/ttx/repos","events_url":"https://api.github.com/users/ttx/events{/privacy}","received_events_url":"https://api.github.com/users/ttx/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-10-26T13:03:53Z","updated_at":"2018-10-26T13:32:59Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/kata-containers/documentation/pulls/286","html_url":"https://github.com/kata-containers/documentation/pull/286","diff_url":"https://github.com/kata-containers/documentation/pull/286.diff","patch_url":"https://github.com/kata-containers/documentation/pull/286.patch"},"body":"Relying on bare HTTP to retrieve release keys or packages\r\nopens yourself to a variety of MITM attacks and root compromises.\r\n\r\nI checked that download.opensuse.org is accessible using https://,\r\nso this should really be used instead.\r\n\r\nSigned-off-by: Thierry Carrez <thierry@openstack.org>"},"comment":{"url":"https://api.github.com/repos/kata-containers/documentation/issues/comments/433408859","html_url":"https://github.com/kata-containers/documentation/pull/286#issuecomment-433408859","issue_url":"https://api.github.com/repos/kata-containers/documentation/issues/286","id":433408859,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMzQwODg1OQ==","user":{"login":"ttx","id":712511,"node_id":"MDQ6VXNlcjcxMjUxMQ==","avatar_url":"https://avatars2.githubusercontent.com/u/712511?v=4","gravatar_id":"","url":"https://api.github.com/users/ttx","html_url":"https://github.com/ttx","followers_url":"https://api.github.com/users/ttx/followers","following_url":"https://api.github.com/users/ttx/following{/other_user}","gists_url":"https://api.github.com/users/ttx/gists{/gist_id}","starred_url":"https://api.github.com/users/ttx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ttx/subscriptions","organizations_url":"https://api.github.com/users/ttx/orgs","repos_url":"https://api.github.com/users/ttx/repos","events_url":"https://api.github.com/users/ttx/events{/privacy}","received_events_url":"https://api.github.com/users/ttx/received_events","type":"User","site_admin":false},"created_at":"2018-10-26T13:32:59Z","updated_at":"2018-10-26T13:32:59Z","author_association":"NONE","body":"Missed that!\r\n\r\nI somewhat disagree with those comments: while it is definitely possible to validate the keys externally, the instructions as posted (for example the 'curl http:// | sudo apt-key add -' posted for Ubuntu) do not include any check that the key matches what is expected and will silently accept any key, so the attack vector is still very much present...\r\n\r\nBut I agree that if some mirrors are not accessible using https:// my change is not the way to fix it."}}
{"actor":{"display_login":"ttx"}}