4 ms·

Genuine question: what are you doing with APT that requires privacy?

by Carpetsmoker 8y ago

arghwhat 8y ago
Nothing requires privacy. However, the HTTPS movement is about making privacy the default, not the exception.
- black-tea 8y ago
  The HTTPS movement is about ensuring that only Google gets your data. It's not about privacy.
  - crankylinuxuser 8y ago
    I don't quite follow. Please explain why Google gets the data.
    - astrodust 8y ago
      Presumably Google Analytics which can embed on HTTPS pages.
      - pasta 8y ago
        Which is already blocked by 40% of the users via ad-blockers. Edit: some report even over 70% that block GA.
        black-tea 8y ago
        Using an adblocker is not part of HTTPS.
dangerface 8y ago
In the past cryptographic export was illegal in the us and many other countries, it can still get you put on a list. In some countries messaging apps like signal and telegram are illegal. There is no telling what seemingly benign software will be made illegal in the future for political reasons. Privacy is always a requirement because of these reasons.
- AstralStorm 8y ago
  Size fingerprinting defeats such "privacy". If you need this, use Tor instead.
  - seqastian 8y ago
    Cause pushing the barrier of how easy it is to detect is a bad thing.
    - zaphar 8y ago
      This is very asymmetric though. The cost for an attacker is very low. The cost for Debian and it's mirror network is very high. Given that the cost of implementation is high and the protection is minimal the decision to not do so is reasonable.
      - Twirrim 8y ago
        > The cost for Debian and it's mirror network is very high. I'm curious how high it actually is. They say it's high, but that could well just be hand-waving. Sure, prior to things like LetsEncrypt those SSL certs would have been a notable financial burden. There's also some extra cost on infrastructure covering the cryptographic workload, but increasingly the processors in servers are capable of handling that without any notable effort.
        jowsie 8y ago
        When someone says the cost is high, most people jump to monetary issues. The cost is in the time and effort required to make the changes, and to have those changes synchronised across every single APT mirror.
        toast0 8y ago
        Certificate cost is trivial. Let's encrypt makes it free, but with a small change to the host names (country code.ftp.debian.org instead of ftp.countrycode.debian.org), all mirrors could have been covered with a single certificate. Some CAs will let you buy one wildcard cert and issue unlimited duplicate certificates with the same name. So, that would cost some money, but probably not too much. The real costs are organizational and technical. Organizing all the different volunteers who are running the mirrors to get certificates installed and updated and configured properly is work. Maybe let's encrypt automation helps here. From a technical perspective, assuming mirrors get any appreciable traffic, adding https adds significantly to the CPU required to provide service. TLS handshaking is pretty expensive, and it adds to the cost of bulk transfer as well. I get the feeling that alot of the volunteer mirrors are running on oldish hardware that happens to have a big enough disk and a nice 10G ethernet. I've run a bulk http download service that enabled https, and after that our dual xeon 2690 (v1) systems ran out of CPU instead of out of bandwidth. CPUs newer than 2012 (Sandy Bridge) do better with TLS tasks, but mirrors might not be running a dual CPU system either.
dingaling 8y ago
For a theoretical example, hiding the fact that I have installed encryption or steganography from my government.
switch007 8y ago
Genuinely: it's 2019: shouldn't privacy be the default?
amaccuish 8y ago
If I was a particular government, I could block apt requests for the tor package e.g.
jermy 8y ago
We deploy our software packages to our own infrastructure and clients using a private APT repository and basic HTTP auth. Obviously we're running it with apt-transport-https installed for making the latter not completely insecure. I see no reason to do that for signed packages from the main repositories, however.
skywhopper 8y ago
None of your business. But! As mentioned above, outside entities being able to monitor exactly which versions of which packages are being installed to which hosts is a significant security risk.
- gnulinux 8y ago
  This sort of comments aren't helpful. Switching to HTTPS will require tremendous amount of work from volunteers. You need to convince me that (1) your usecase exists (2) your usecase can be remedied with HTTPS.

Genuine question: what are you doing with APT that requires privacy?

arghwhat 8y ago

Nothing requires privacy. However, the HTTPS movement is about making privacy the default, not the exception.

black-tea 8y ago
The HTTPS movement is about ensuring that only Google gets your data. It's not about privacy.
- crankylinuxuser 8y ago
  I don't quite follow. Please explain why Google gets the data.
  - astrodust 8y ago
    Presumably Google Analytics which can embed on HTTPS pages.
    - pasta 8y ago
      Which is already blocked by 40% of the users via ad-blockers. Edit: some report even over 70% that block GA.
      - black-tea 8y ago
        Using an adblocker is not part of HTTPS.

dangerface 8y ago

In the past cryptographic export was illegal in the us and many other countries, it can still get you put on a list. In some countries messaging apps like signal and telegram are illegal. There is no telling what seemingly benign software will be made illegal in the future for political reasons. Privacy is always a requirement because of these reasons.

AstralStorm 8y ago
Size fingerprinting defeats such "privacy". If you need this, use Tor instead.
- seqastian 8y ago
  Cause pushing the barrier of how easy it is to detect is a bad thing.
  - zaphar 8y ago
    This is very asymmetric though. The cost for an attacker is very low. The cost for Debian and it's mirror network is very high. Given that the cost of implementation is high and the protection is minimal the decision to not do so is reasonable.
    - Twirrim 8y ago
      > The cost for Debian and it's mirror network is very high. I'm curious how high it actually is. They say it's high, but that could well just be hand-waving. Sure, prior to things like LetsEncrypt those SSL certs would have been a notable financial burden. There's also some extra cost on infrastructure covering the cryptographic workload, but increasingly the processors in servers are capable of handling that without any notable effort.
      - jowsie 8y ago
        When someone says the cost is high, most people jump to monetary issues. The cost is in the time and effort required to make the changes, and to have those changes synchronised across every single APT mirror.
      - toast0 8y ago
        Certificate cost is trivial. Let's encrypt makes it free, but with a small change to the host names (country code.ftp.debian.org instead of ftp.countrycode.debian.org), all mirrors could have been covered with a single certificate. Some CAs will let you buy one wildcard cert and issue unlimited duplicate certificates with the same name. So, that would cost some money, but probably not too much. The real costs are organizational and technical. Organizing all the different volunteers who are running the mirrors to get certificates installed and updated and configured properly is work. Maybe let's encrypt automation helps here. From a technical perspective, assuming mirrors get any appreciable traffic, adding https adds significantly to the CPU required to provide service. TLS handshaking is pretty expensive, and it adds to the cost of bulk transfer as well. I get the feeling that alot of the volunteer mirrors are running on oldish hardware that happens to have a big enough disk and a nice 10G ethernet. I've run a bulk http download service that enabled https, and after that our dual xeon 2690 (v1) systems ran out of CPU instead of out of bandwidth. CPUs newer than 2012 (Sandy Bridge) do better with TLS tasks, but mirrors might not be running a dual CPU system either.

dingaling 8y ago

For a theoretical example, hiding the fact that I have installed encryption or steganography from my government.

switch007 8y ago

Genuinely: it's 2019: shouldn't privacy be the default?

amaccuish 8y ago

If I was a particular government, I could block apt requests for the tor package e.g.

jermy 8y ago

We deploy our software packages to our own infrastructure and clients using a private APT repository and basic HTTP auth. Obviously we're running it with apt-transport-https installed for making the latter not completely insecure. I see no reason to do that for signed packages from the main repositories, however.

skywhopper 8y ago

None of your business. But! As mentioned above, outside entities being able to monitor exactly which versions of which packages are being installed to which hosts is a significant security risk.

gnulinux 8y ago
This sort of comments aren't helpful. Switching to HTTPS will require tremendous amount of work from volunteers. You need to convince me that (1) your usecase exists (2) your usecase can be remedied with HTTPS.