3 ms·
The point of the article is that Debian's trust model does not privilege the package servers - anyone can set one up, using whatever hair-brained technology the
by dTal 8y ago
The point of the article is that Debian's trust model does not privilege the package servers - anyone can set one up, using whatever hair-brained technology they want (even, say, BitTorrent). The packages are individually signed and verified. SSL doesn't get you anything. It's the end-to-end principle in action.
- majewsky 8y ago> SSL doesn't get you anything. With TLS, Eve cannot see (as easily) which packages Alice is downloading from Bob's mirror. If she could, Eve could use that information to decide which exploitable applications to target on Alice's machine.
- pdw 8y agoEven with TLS, Eve can still see the size of the transfer. That's enough to reliably guess which packages were fetched.
- rhacker 8y agoThis was discussed elsewhere in the same discussion - basically the size of a download would be too similar for many packages and the fact that there are keep-alives would make it look like on impossible to decrypt stream anyway with no sizing data at all.