5 ms·

You're downloading form a third-party volunteer. What protocol can provide privacy given that condition?

by Arnt 8y ago

rhacker 8y ago
Instead of JUST that third party knowing what (possibly vulnerable) packages you have, you are now letting everyone know what possibly vulnerable packages you have.
- altfredd 8y ago
  > you are now letting everyone know what possibly vulnerable packages you have. Erm, what? The number of people, who can listen to (much less — modify) your traffic is very small. It is basically your ISP (who is supposed to offers you services in good faith, not spy on you) and a number of engineers, who maintain Internet backbone. That's far from "everyone". Some SSL evangelists make it sound like everyone's traffic is permanently broadcasted to everyone else in the world, but it is not. As for "vulnerable packages", the most certain sign, that someone does not install security updates, is lack of traffic between them and update servers. But that's orthogonal to use of encryption.
  - DoctorOetker 8y ago
    "everyone" in this context obviously means everyone on the path, and any attackers that have compromised nodes along the path. See the Belgacom hack by 5 eyes...
    - monocasa 8y ago
      And I those attackers can still tell everything based on the target IP and the payload sizes.
      - DoctorOetker 8y ago
        there is no proof that this is true in general, so it is worth trying to find 1) an inefficient way in order to 2) postulate an efficient way... for example, overlay onion routing, size blurring by appending random length random bits,... with oblivious transfer even the APT-server does not know what you downloaded (but that would require a large amount of information..., nevertheless oblivious transfer might still be a useful tool when used as a primitive, perhaps just to send a list of bootstrap addresses for p2p hosting of the signed files etc...)
arghwhat 8y ago
There is a huge difference between the third-party knowing what you're doing, and everyone in between knowing what you're doing. The HTTPS everywhere movements are attempting to make privacy the default rather than the exception, but are of course done knowing that the server will always know whats up. The point is to make it so that only the two parties concerned, the server and the client, comprehend the communication rather than the entire world
- Arnt 8y ago
  Okay, suppose I want to know what packages you're installing and updating. I have two routes: 1. I gain access to a router near you. 2. I rent a sizable server at the hetzner/ovh/… location that's closest to you and volunteer to run a mirror for the OS you're using. Both are somewhat uncertain (your traffic might flow via a different route, you might be load-balanced to a different mirror) but the uncertainty seems comparable. Option 2 seems so much easier that I have a real problem seeing the point of even attempting option 1 if all I want is the information option 2 would give. Perhaps someone can explain?
  - arghwhat 8y ago
    You'd have to take control over my mirror. Making a new mirror will not get you any traffic unless people actively choose to use it. Therefore, your option 1. is to control a part of the public route, and option 2. is to control the mirror of my choice. However, any argument against using encryption for privacy for APT can equally be applied to any other traffic. Do you trust your public internet route enough to let your traffic run authenticated, but unencrypted? Chats, news, bank statements, software updates? Even if content cannot be modified, it can still be blocked or made public. There are quite a few nosy governments that would like to know or block certain types of content, software packages included.
    - AstralStorm 8y ago
      You will instantly spot blocking because apt reports connection failure and hash failure and replay attack on update list is ineffective. As for privacy, eh? It is visible you're connecting to a debian mirror and what size of update list you're getting. Barring that, indexing packages by size is trivial. You want true privacy, you'd have to use Tor or such.

You're downloading form a third-party volunteer. What protocol can provide privacy given that condition?

by Arnt 8y ago

You're downloading form a third-party volunteer. What protocol can provide privacy given that condition?

Instead of JUST that third party knowing what (possibly vulnerable) packages you have, you are now letting everyone know what possibly vulnerable packages you have.

altfredd 8y ago
> you are now letting everyone know what possibly vulnerable packages you have. Erm, what? The number of people, who can listen to (much less — modify) your traffic is very small. It is basically your ISP (who is supposed to offers you services in good faith, not spy on you) and a number of engineers, who maintain Internet backbone. That's far from "everyone". Some SSL evangelists make it sound like everyone's traffic is permanently broadcasted to everyone else in the world, but it is not. As for "vulnerable packages", the most certain sign, that someone does not install security updates, is lack of traffic between them and update servers. But that's orthogonal to use of encryption.
- DoctorOetker 8y ago
  "everyone" in this context obviously means everyone on the path, and any attackers that have compromised nodes along the path. See the Belgacom hack by 5 eyes...
  - monocasa 8y ago
    And I those attackers can still tell everything based on the target IP and the payload sizes.
    - DoctorOetker 8y ago
      there is no proof that this is true in general, so it is worth trying to find 1) an inefficient way in order to 2) postulate an efficient way... for example, overlay onion routing, size blurring by appending random length random bits,... with oblivious transfer even the APT-server does not know what you downloaded (but that would require a large amount of information..., nevertheless oblivious transfer might still be a useful tool when used as a primitive, perhaps just to send a list of bootstrap addresses for p2p hosting of the signed files etc...)

arghwhat 8y ago

There is a huge difference between the third-party knowing what you're doing, and everyone in between knowing what you're doing. The HTTPS everywhere movements are attempting to make privacy the default rather than the exception, but are of course done knowing that the server will always know whats up. The point is to make it so that only the two parties concerned, the server and the client, comprehend the communication rather than the entire world

Arnt 8y ago
Okay, suppose I want to know what packages you're installing and updating. I have two routes: 1. I gain access to a router near you. 2. I rent a sizable server at the hetzner/ovh/… location that's closest to you and volunteer to run a mirror for the OS you're using. Both are somewhat uncertain (your traffic might flow via a different route, you might be load-balanced to a different mirror) but the uncertainty seems comparable. Option 2 seems so much easier that I have a real problem seeing the point of even attempting option 1 if all I want is the information option 2 would give. Perhaps someone can explain?
- arghwhat 8y ago
  You'd have to take control over my mirror. Making a new mirror will not get you any traffic unless people actively choose to use it. Therefore, your option 1. is to control a part of the public route, and option 2. is to control the mirror of my choice. However, any argument against using encryption for privacy for APT can equally be applied to any other traffic. Do you trust your public internet route enough to let your traffic run authenticated, but unencrypted? Chats, news, bank statements, software updates? Even if content cannot be modified, it can still be blocked or made public. There are quite a few nosy governments that would like to know or block certain types of content, software packages included.
  - AstralStorm 8y ago
    You will instantly spot blocking because apt reports connection failure and hash failure and replay attack on update list is ineffective. As for privacy, eh? It is visible you're connecting to a debian mirror and what size of update list you're getting. Barring that, indexing packages by size is trivial. You want true privacy, you'd have to use Tor or such.