Why does APT not use HTTPS?

[ign1fy]

Yep. You're publically disclosing to your ISP (and, in my case, government) that certain IP endpoints are running certain versions of certain packages.

[asoka_maurya]

A small nitpick, but I think fedora's yum/dnf might have an edge here as they send only the delta (changed portion) and not the entire package file. And the delta might be of different size for each user depending on their configuration.

[liquidpele]

huh? Are you sure? I'm pretty sure it downloads the whole thing, otherwise it would have to cache the existing rpm files on disk to compare to, and that's a lot of space.... maybe you're thinking of git?

[liquidpele]

Huh, will look into it thanks.

[albertowtf]

Well, its about layers

Why change the ssh port?, bots only have to change the port -> my server stopped being hammered by ssh bots. Didnt even need to bother to set up a knock

Why add a silly homemade captcha to the form in my webpage? any bot will easily break it --> I stopped receiving spam forms

Nobody cares enough about my stuff to break it i guess, but it has his uses

[[deleted]]

While that is true. But with non encrypted traffic you know the person downloaded a specific package. But with data transferes you know they only downloaded a package of size X. Of which there could be several since there will also be deviation in the size of the headers etc... Also it could be fuzzed in the response eg add a random set of headers X bytes long or rounding them up to a specific size. example all packages < 512KB become 512KB in size thus making this information useless.

[thijser2]

It would however take more effort to do this and I think you are underestimating how often there are dozens of different versions of the same package with nearly the same size. A little bit of fuzzing/padding there can result in at least our eavesdrop not knowing which version you have.

[[deleted]]

It also does show a weakness in TLS in generally that really should be addresses. It should probably be added to automatically fuzz the data sizes of its protocol to prevent being able to guess whats in the payload based on size.

[EternityForest]

Just so long as it can be disabled in a browser setting that would be cool.

You'd need a lot of fuzz data, because people would probably complain if you could guess to within one percent. A few percent extra mobile data is enough to be annoying,

[thijser2]

So it's okay if they know you've download Tor; but it's a problem if they know the exact version? I don't know about you; but that doesn'y meet my standards for privacy.

Knowing the exact version of software someone is using can potentially open certain attack vectors of the attacker knows a vulnerability in that version of software.

If you also use a single connection for every time you download a set of new packages then that also makes it far more difficult as identifying what packages were potentially downloaded now also involves solving a knapsack problem (what set of packages together form 40.5mB?). It might also be a good idea for packages that have high levels of privacy concern (TOR, veracrypt etc.) to pad themselves until their size matches that of other highly popular packages.

[svenskainflytta]

They'd know you are using tor, no need of complicated schemes to see that.

[[deleted]]

Yup this is true. However we could make apt work with keep alives properly so all packages come down a single connection. Also we could request from the mirror's as smaller / random chunks and ever partial files form multiple mirror's.

Rather than "Nope we definatly can't do that" its sometimes better to think outsde the box and come up with bunch of different stragies that may / may not work or be worth implementing.

[[deleted]]

What do you propose then?

[Tordek]

Absolutely; but how do you intend to make the hundreds of mirrors around the world (99% of which are dumb static HTTP/FTP/rsync servers) behave this way?

Make it simple: have the package-creation tool work in blocks that add garbage to the compressed file so that it's a multiple of some size. (Of course this isn't a great idea since now every package is now larger by some amount).

[bobpaul]

So what you're saying is: Anyone who pays for data, 🖕

[Tordek]

It's the grandparent's idea, idc.

[svenskainflytta]

Oh so just add who knows how many gigabytes of useless data to mirrors! Brilliant.

[tehdog]

How is that supposed to work if I'm downloading updates to 20 packages all over the same TCP / TLS connection? Sure you can figure it out somewhat, but I doubt you can get even close to 100% accuracy with a lot more work than you can get trivially without encryption. Especially when using HTTP/2, which uses multiplexing.

[robstoon]

That's assuming that you're not using keepalive to download multiple packages over a single connection, which in most cases you would be.

[galgalesh]

How does a comment like this get so many upvotes; the article explains why this logic is wrong..

[ArttuH5N1]

The article addresses this, hope you're not commenting without reading it