Security implications?

[justinsb]

(Originally asked as Question #152345, but converted to a bug as requested)

I think the squid deb proxy combined with zeroconf is a brilliant idea. I have a question about security: presumably with zeroconf anyone on my network could advertise a proxy; I know that everything is GPG signed, so there's no (realistic) risk of getting fake packages, but presumably an attacker could still serve old repositories with known vulnerabilities (?)

Is there a way to force the request for the 'Release' file to go to an official ubuntu server (ideally over https), while still downloading every other file from the proxy?

[Dustin Kirkland  (kirkland)]

Marking 'High'. Marking 'Incomplete', waiting for feedback from the Ubuntu Security Team (subscribed).

Ubuntu-Security-

What do you think?

[Jamie Strandboge (jdstrand)]

Thank you for using Ubuntu and reporting a bug. Apt has protections that prevent replay attacks as described (see http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499897 for more information). I am therefore marking this bug as 'Invalid'. Please feel free to report any other bugs you may find.