4 ms·

One thing that wasn't touched on - the mirror network. There are 100's of mirrors for all the major distros ran by third parties, if e.g. Debian wanted apt over

One thing that wasn't touched on - the mirror network. There are 100's of mirrors for all the major distros ran by third parties, if e.g. Debian wanted apt over HTTPS, they would need to hand out a debian.org SSL cert+key to all of them. (And convince them all to take the CPU overhead hit of TLS) EDIT: Since I can't reply to all the downvoters, I'll add here.. LetsEncrypt does not solve this. http://us.archive.ubuntu.com/ http://us.archive.ubuntu.com/ - that goes to likely 10's of different mirrors. Which one will the LetsEncrypt verification call hit?

majewsky 8y ago
So? In the age of Let's Encrypt, this task is (or rather, should be) downright trivial. Source: Using multiple dozens of LE-issued certs without even thinking about it.
zaarn 8y ago
What? No. The mirrors would just need to install a letsencrypt-compatible client and setup SSL via that. On any modern CPU since 2011 or so, TLS overhead is below a percent and a decent cheap dedicated box should be able to saturate a 1 Gbps uplink.
- toast0 8y ago
  Actually, no, the mirrors may not be able to verify themselves with let's encrypt. A hostname like ftp.us.debian.org resolves to many different mirrors, and may not resolve consistently around the world -- if that's the case, let's encrypt will not be able to verify the hosts through http challenges. Also, 1gbps is pretty small. I can't find any documentation on traffic, but I'd imagine mirrors in popular places are at least on 10gig.
  - zaarn 8y ago
    I have a 10Gbps uplink on my personal server and I can easily saturate it without getting capped on CPU or RAM. LE offers other challenges to verify hosts, like DNS verification. DNS verification can be done easily with an external API for mirror owners to hit (most ACME clients offer DNS challenge with the standard update protocol for DNS which can be secure appropriately).
    - toast0 8y ago
      Mirror owners don't control the DNS for debian.org. Debian could get the certificates, but getting the certificates was never the issue -- some CA would be happy to issue certificates for little or no cost to help Debian and gain mindshare. Coordination between 3rd party, volunteer mirror owners and the Debian organization is the issue. What kind of CPU and traffic patterns are you using to hit 10 gbps of TLS protected traffic?
      - zaarn 8y ago
        >What kind of CPU and traffic patterns are you using to hit 10 gbps of TLS protected traffic? Mainly serving a file directory with apache with files ranging between 100M and 1G in size. Should be easily comparable to Debian or Ubuntu repositories.
        toast0 8y ago
        Debian mirrors are going to get a lot of _very_ short connections for people checking if there are any updates frequently. Those are effectively zero bandwidth, but you need to do a full TLS handshake, which is the most expensive part.
        zaarn 8y ago
        A dedicated server of decent size should easily be able to handle this kind of traffic.
        toast0 8y ago
        I agree; you would need a dedicated server of decent size to handle this type of traffic. Debian relies on an assortment of volunteer servers of unknown size, and they're not dedicated.
        zaarn 8y ago
        A dedicated server of decent size at the right hoster starts at 25€ a month. That is not that much and I bet most of the volunteer servers are already above this price range.
bkor 8y ago
That's only for the mirrors which have a shared debian.org hostname. If you use e.g. mirrorbrain it'll redirect to the closest mirror. Based upon https://www.debian.org/mirror/list https://www.debian.org/mirror/list, it seems they all have pretty much unique hostnames (ftp.<COUNTRY>.debian.org). You can easily get a certificate for that. In brief: It's not a huge issue to get a certificate.
- kiallmacinnes 8y ago
  ftp.<COUNTRY>.debian.org is unique per country, however in many cases, there are multiple mirrors in a given country.
AaronFriel 8y ago
That was largely the case until recently, but I don't think it would be difficult now to set up LetsEncrypt and do HTTP-01 challenges. A slightly more complicated set up, but one entirely within the Debian org's means, would be to use the DNS-01 challenge. But to the article's point, the DNS requests and IPs and file sizes would all be largely transparent, and that's probably enough to figure out what's being downloaded. On the other hand, HTTP/2 could improve throughput and ensure proxies aren't tampering or replaying.

majewsky 8y ago

So? In the age of Let's Encrypt, this task is (or rather, should be) downright trivial. Source: Using multiple dozens of LE-issued certs without even thinking about it.

zaarn 8y ago

What? No. The mirrors would just need to install a letsencrypt-compatible client and setup SSL via that. On any modern CPU since 2011 or so, TLS overhead is below a percent and a decent cheap dedicated box should be able to saturate a 1 Gbps uplink.

toast0 8y ago
Actually, no, the mirrors may not be able to verify themselves with let's encrypt. A hostname like ftp.us.debian.org resolves to many different mirrors, and may not resolve consistently around the world -- if that's the case, let's encrypt will not be able to verify the hosts through http challenges. Also, 1gbps is pretty small. I can't find any documentation on traffic, but I'd imagine mirrors in popular places are at least on 10gig.
- zaarn 8y ago
  I have a 10Gbps uplink on my personal server and I can easily saturate it without getting capped on CPU or RAM. LE offers other challenges to verify hosts, like DNS verification. DNS verification can be done easily with an external API for mirror owners to hit (most ACME clients offer DNS challenge with the standard update protocol for DNS which can be secure appropriately).
  - toast0 8y ago
    Mirror owners don't control the DNS for debian.org. Debian could get the certificates, but getting the certificates was never the issue -- some CA would be happy to issue certificates for little or no cost to help Debian and gain mindshare. Coordination between 3rd party, volunteer mirror owners and the Debian organization is the issue. What kind of CPU and traffic patterns are you using to hit 10 gbps of TLS protected traffic?
    - zaarn 8y ago
      >What kind of CPU and traffic patterns are you using to hit 10 gbps of TLS protected traffic? Mainly serving a file directory with apache with files ranging between 100M and 1G in size. Should be easily comparable to Debian or Ubuntu repositories.
      - toast0 8y ago
        Debian mirrors are going to get a lot of _very_ short connections for people checking if there are any updates frequently. Those are effectively zero bandwidth, but you need to do a full TLS handshake, which is the most expensive part.
        zaarn 8y ago
        A dedicated server of decent size should easily be able to handle this kind of traffic.
        toast0 8y ago
        I agree; you would need a dedicated server of decent size to handle this type of traffic. Debian relies on an assortment of volunteer servers of unknown size, and they're not dedicated.
        zaarn 8y ago
        A dedicated server of decent size at the right hoster starts at 25€ a month. That is not that much and I bet most of the volunteer servers are already above this price range.

bkor 8y ago

That's only for the mirrors which have a shared debian.org hostname. If you use e.g. mirrorbrain it'll redirect to the closest mirror. Based upon https://www.debian.org/mirror/list https://www.debian.org/mirror/list, it seems they all have pretty much unique hostnames (ftp.<COUNTRY>.debian.org). You can easily get a certificate for that. In brief: It's not a huge issue to get a certificate.

kiallmacinnes 8y ago
ftp.<COUNTRY>.debian.org is unique per country, however in many cases, there are multiple mirrors in a given country.

AaronFriel 8y ago

That was largely the case until recently, but I don't think it would be difficult now to set up LetsEncrypt and do HTTP-01 challenges. A slightly more complicated set up, but one entirely within the Debian org's means, would be to use the DNS-01 challenge. But to the article's point, the DNS requests and IPs and file sizes would all be largely transparent, and that's probably enough to figure out what's being downloaded. On the other hand, HTTP/2 could improve throughput and ensure proxies aren't tampering or replaying.