# Pain the APT

URL: /show/linux-unplugged/285/
> An embarrassing vulnerability has been found in the apt package manager, we’ll break it all down. Plus Alessandro Castellani tells us about his plans to build a professional design tool for Linux.

- Show: [LINUX Unplugged](/show/linux-unplugged/)
- Episode: 285
- Date: 2019-01-22
- Hosts: chris, wes
- Guests: alessandro, brent
- Duration: 01:19:51
- Audio: https://aphid.fireside.fm/d/1437767933/f31a453c-fa15-491f-8618-3f71f1d565e5/b37be25b-89fa-40f9-a64c-41fbf767131c.mp3
- YouTube: https://www.youtube.com/watch?v=pfu4vW1kzoM





### Episode Links

  * [OggCamp 19](https://oggcamp.org/ "OggCamp 19") — OggCamp is an unconference celebrating Free Culture, Free and Open Source Software, hardware hacking, digital rights, and all manner of collaborative cultural activities.
  * [OggCamp on Twitter](https://twitter.com/oggcamp "OggCamp on Twitter")
  * [Remote Code Execution in apt-get](https://justi.cz/security/2019/01/22/apt-rce.html "Remote Code Execution in apt-get") — A vulnerability in apt allows a network man-in-the-middle (or a malicious package mirror) to execute arbitrary code as root on a machine installing any package. The bug has been fixed in the latest versions of apt.
  * [Why does APT not use HTTPS?](https://whydoesaptnotusehttps.com/ "Why does APT not use HTTPS?")
  * [Turkish ISP Swapped Downloads of Popular Software with Spyware-Infected Apps](https://www.bleepingcomputer.com/news/security/turkish-isp-swapped-downloads-of-popular-software-with-spyware-infected-apps/ "Turkish ISP Swapped Downloads of Popular Software with Spyware-Infected Apps")
  * [Which block I/O scheduler is the best? We asked eBPF.](https://www.circonus.com/2019/01/which-block-i-o-scheduler-is-the-best-we-asked-ebpf/ "Which block I/O scheduler is the best? We asked eBPF.") — I set out expecting to see differing distributions of latencies for each block scheduler, but ultimately found that I didn’t understand low-level systems behavior to the degree I thought I did.
  * [Want to spin up Ubuntu VMs from Windows 10's command line, eh? We'll need to see a Multipass.](https://www.theregister.co.uk/2019/01/22/multipass/ "Want to spin up Ubuntu VMs from Windows 10's command line, eh? We'll need to see a Multipass.") — Windows 10 developers have been gifted yet another way of running Linux on their desktop in the form of Canonical's Multipass. 
  * [Microsoft Employee Hints at Windows Core OS Open Source Components](https://www.tomshardware.com/news/microsoft-employee-leaks-windows-core-open-source-components,38476.html "Microsoft Employee Hints at Windows Core OS Open Source Components")
  * [TechSNAP Episode 395: The ACME Era](https://techsnap.systems/395 "TechSNAP Episode 395: The ACME Era")
  * [LinuxFest Northwest 20th Anniversary](https://linuxfestnorthwest.org/conferences/2019 "LinuxFest Northwest 20th Anniversary")
  * [LFNW Telegram Group](https://t.me/linuxfest2019 "LFNW Telegram Group")
  * [LinuxFest Northwest Parking Lot BBQ Meetup](https://www.meetup.com/jupiterbroadcasting/events/258303320/ "LinuxFest Northwest Parking Lot BBQ Meetup")
  * [SCALE 17x](https://www.socallinuxexpo.org/scale/17x "SCALE 17x")
  * [SCALE Telegram Group](https://t.me/joinchat/DgyWhBZyAm7Q18a2NBkElw "SCALE Telegram Group")
  * [Texas Linux Fest 2019](https://2019.texaslinuxfest.org/ "Texas Linux Fest 2019")
  * [Public Speaking: A repository of resources about public speaking, specifically in the context of software development and IT conferences.](https://github.com/vmbrasseur/Public_Speaking#proposing-talks "Public Speaking: A repository of resources about public speaking, specifically in the context of software development and IT conferences.")
  * [Linux Operating System Fundamentals](https://linuxacademy.com/linux/training/course/name/linux-operating-system-fundamentals "Linux Operating System Fundamentals") — Have you heard of Linux, but don't really know anything about it? Are you a non-technical person just wanting to know what this 'Linux' thing is? Then this course is for you.
  * [Akira: Native Linux App for UI and UX Design](https://github.com/Alecaddd/Akira "Akira: Native Linux App for UI and UX Design")
  * [Akira on Kickstarter](https://www.kickstarter.com/projects/alecaddd/akira-the-linux-design-tool/?ref=kicktraq "Akira on Kickstarter")
  * [Exponent episode 159 — Inverted Pyramids](https://exponent.fm/episode-159-inverted-pyramids/ "Exponent episode 159 — Inverted Pyramids")
  * [Late Night Linux – Episode 55](https://latenightlinux.com/late-night-linux-episode-55/ "Late Night Linux – Episode 55") — Are you better off with the elasticity of public clouds like AWS, or should you avoid lock-in by running servers on premises?
  * [AWS, MongoDB, and the Economic Realities of Open Source](https://stratechery.com/2019/aws-mongodb-and-the-economic-realities-of-open-source/ "AWS, MongoDB, and the Economic Realities of Open Source")
  * [Open source confronts its midlife crisis](http://dtrace.org/blogs/bmc/2018/12/14/open-source-confronts-its-midlife-crisis/ "Open source confronts its midlife crisis")