3 ms·
Well, it doesn't seem like a well known concept (and it was new to me that torrents can do such a thing). How is the proposed concept in any way less secure th
by onli 13y ago
Well, it doesn't seem like a well known concept (and it was new to me that torrents can do such a thing).
How is the proposed concept in any way less secure than the given model? You already have to trust the source that the file is the promised one and not a infected, and you already have to trust your peers not to log your ip and sue you. An update-url shouldn't change much.
- shdon 13y agoAfaict, you don't actually need to be downloading the content in order to check for updates and the signing is not mandatory ("should be signed" not "must be signed"). Don't the content providers already pose as peers and even share (sometimes corrupted) torrents in order to track down infringement? The feed could even be legitimate in and of itself, even when signed, but still pass on user information to a centralised server. I'm no security expert and it's quite possible that it's all quite safe, but to my layman's eyes it seems there's substantial potential for abuse, especially to unsuspecting users.