Hey there.

Would you possibly consider to tighten the Valid-Until times on the
various repositories?


E.g. stable and testing security seems to have 1 week right now.

This seems pretty long,... a whole week in which an attacker might
do a blocking attack and prevent people from noticing that they're
not seeing any updates?


Current stable (buster) doesn't seem to have a Valid-Until at all.
Not sure if this is planned for bullseye as well.
The impact is perhaps not that big, since the security upgrades
go anyway to bullseye-security.
But still perhaps better to have a validity than not?


I would have blindly guessed that using shorter Valid-Until times
isn't that expensive, cause it's probably just the dates that
need to be refresehed and the signature on the Release file?



What about a validity time of e.g. one day,... at least for repos like
unstable, *-security, *-updates? Maybe also testing?

And maybe a 1-2 weeks or so for any repo where security is anyway handled
in another (stable)?


Thanks for your consideration,
Chris.