3 ms·

As cool as this is, isn't it a rather glaring security risk? Who is to say that the embedded URL isn't malicious? Or a nefarious tracking link inserted by RIAA/

• gatehouse 13y ago
  The BEP suggests that torrents that do this should include a public key in the original torrent, and then the update must be signed with the corresponding private key. So the idea is if you trusted the original you should trust the update.
• onli 13y ago
  Well, it doesn't seem like a well known concept (and it was new to me that torrents can do such a thing). How is the proposed concept in any way less secure than the given model? You already have to trust the source that the file is the promised one and not a infected, and you already have to trust your peers not to log your ip and sue you. An update-url shouldn't change much.
  • shdon 13y ago
    Afaict, you don't actually need to be downloading the content in order to check for updates and the signing is not mandatory ("should be signed" not "must be signed"). Don't the content providers already pose as peers and even share (sometimes corrupted) torrents in order to track down infringement? The feed could even be legitimate in and of itself, even when signed, but still pass on user information to a centralised server. I'm no security expert and it's quite possible that it's all quite safe, but to my layman's eyes it seems there's substantial potential for abuse, especially to unsuspecting users.