3 ms·
but.. for apt archives, the integrity is provided by gpg.. TLS doesn't really add value for this.. However, it does provide confidentiality, such that an actor
by Daviey 10y ago
but.. for apt archives, the integrity is provided by gpg.. TLS doesn't really add value for this.. However, it does provide confidentiality, such that an actor MITM'ing can't see what software is being downloaded.
- xena 10y agoThere are multiple layers of encryption you get for free by using a tor hidden service.
- M2Ys4U 10y agoLooking at the actual list of packages being requested isn't the only way to see what software is being downloaded. An attacker could also see the size of the packages being transferred. Using the dependency tree would help in determining what packages have been downloaded. Though I admit this is a higher barrier than just reading the list of packages.
- tedks 10y agoDefense in depth.