2 ms·
Maybe not for individual software projects, but I would like to see something like this for installing and updating packages via the OS's package manager. Give
by u801e 5y ago
Maybe not for individual software projects, but I would like to see something like this for installing and updating packages via the OS's package manager. Given the fact that package repositories have mirror servers, it should definitely be possible.
- perihelions 5y agoSounds like something that would have significant security impact, wouldn't it?
- Jtsummers 5y agoBT is resistant to content spoofing. So unless the users download arbitrary .torrent files from untrusted sources, it will be hard to inject malware this way. You'd need to find hash collisions for the contents of the torrent. It would have some privacy implications, as you end up announcing "I'm using this OS!" to your peers (well, it's a high probability that you are at least).
- perihelions 5y agoThe same's true for ordinary package managers, but they've come with CVE's that allowed circumventing checksum validation [0]. Software mirror security doesn't seem to me (non-expert) a trivial or solved problem. [0] https://news.ycombinator.com/item?id=8330386 https://news.ycombinator.com/item?id=8330386