4 ms·

At the end of the day, there's a trust issue. The way distribution works nowadays, mitigates a lot of those. Making it decentralised would be a step backwards.

ciupicri 2y ago
Aren't the RPMs signed?
BSDobelix 2y ago
You know that packages are signed right? That's why everyone can be a libreoffice or ArchLinux Mirror...or Fedora?
- deleted 2y ago
  [deleted]
- aaomidi 2y ago
  And because of this, these mirrors are often non https so your ISP can actually intercept and provide the data to you directly. This is why torrents would actually work fine in this model.
  - Cyphase 2y ago
    Where intercept usually means point DNS for the mirror domains to the ISP's local mirror, and ISP could mean your cloud provider.
  - BSDobelix 2y ago
    >ISP can actually intercept and provide the data to you directly What a nice gesture! However my mirror-servers are https plus rsync (for some projects). But are there not some ISP's that block torrent-traffic completely?
    - aaomidi 2y ago
      BitTorrent is hard to block completely from my understanding of how the protocol works, but I may be wrong.
  - crest 2y ago
    Unless you can break the SHA1 hashes for the torrent chunks and the global hash torrents also authenticate the content. If you have a valid "info" dictionary at least.
- adobrawy 2y ago
  A digital signature does not protect you against a malicious actor who starts distributing outdated, vulnerable versions to you.
  - BSDobelix 2y ago
    How do i know you don't know what your talking about?....a mystery ;)
    - adobrawy 2y ago
      I mean replay attack and freeze attack as described in https://doi.org/10.1145/1455770.1455841 https://doi.org/10.1145/1455770.1455841 . It's very likely that I'm not up to date on mitigations in individual package managers.
      - BSDobelix 2y ago
        >all of these package managers have vulnerabilities that can be exploited by a man-in-the-middle or a malicious mirror. Well, that's how software is, but that article is from 2008 and things have gotten a lot better in the meantime (I think archlinux wasn't even signing their packages back then). If the distribution's private keyring isn't compromised and you don't have third-party repos, your packages are as trustworthy as your distribution team (and upstream).
Cyphase 2y ago
Packages can be and generally are signed and verified.

ciupicri 2y ago

Aren't the RPMs signed?

BSDobelix 2y ago

You know that packages are signed right? That's why everyone can be a libreoffice or ArchLinux Mirror...or Fedora?

deleted 2y ago
[deleted]
aaomidi 2y ago
And because of this, these mirrors are often non https so your ISP can actually intercept and provide the data to you directly. This is why torrents would actually work fine in this model.
- Cyphase 2y ago
  Where intercept usually means point DNS for the mirror domains to the ISP's local mirror, and ISP could mean your cloud provider.
- BSDobelix 2y ago
  >ISP can actually intercept and provide the data to you directly What a nice gesture! However my mirror-servers are https plus rsync (for some projects). But are there not some ISP's that block torrent-traffic completely?
  - aaomidi 2y ago
    BitTorrent is hard to block completely from my understanding of how the protocol works, but I may be wrong.
- crest 2y ago
  Unless you can break the SHA1 hashes for the torrent chunks and the global hash torrents also authenticate the content. If you have a valid "info" dictionary at least.
adobrawy 2y ago
A digital signature does not protect you against a malicious actor who starts distributing outdated, vulnerable versions to you.
- BSDobelix 2y ago
  How do i know you don't know what your talking about?....a mystery ;)
  - adobrawy 2y ago
    I mean replay attack and freeze attack as described in https://doi.org/10.1145/1455770.1455841 https://doi.org/10.1145/1455770.1455841 . It's very likely that I'm not up to date on mitigations in individual package managers.
    - BSDobelix 2y ago
      >all of these package managers have vulnerabilities that can be exploited by a man-in-the-middle or a malicious mirror. Well, that's how software is, but that article is from 2008 and things have gotten a lot better in the meantime (I think archlinux wasn't even signing their packages back then). If the distribution's private keyring isn't compromised and you don't have third-party repos, your packages are as trustworthy as your distribution team (and upstream).

Cyphase 2y ago

Packages can be and generally are signed and verified.