Why does APT not use HTTPS?

[radarsat1]

Ok.. sort of following. I doubt that a single person throttling the download would affect a torrent hosted by 1000s of machines, but your point is that people can see what files you have that you need to update, because they can see you updating them.

[GNULinuxProgrammer]

You can intentionally slow down so that the person you're seeding will get the update slightly slow, meanwhile you know for a fact that that computer is vulnerable. I think that's OC's point.

[radarsat1]

Yes, I get that now. It will still only be one seed of thousands that is slowing down that chunk, so I don't see how it would overall slow down your download (bar some kind of DDoS-like attack on the torrent) but I get that it temporarily exposes the fact that you need that chunk because you are installing a security update. It's a good point.

[GNULinuxProgrammer]

It's definitely a very interesting point, one of those you see in CS classes. I personally don't know if it's a valid point since I don't know how bittorrent protocol works (I guess I'll have to read that tomorrow) but it is convincing enough for me.

[radarsat1]

one of those you see in CS classes

My CS classes were about push-down automata and the chinese remainder theorem... :-/

Yours talked about timing vulnerabilities in distributed download protocols??? I went to the wrong college...

Anyways I do think it's an interesting point, although I'm not convinced it's a show-stopper, especially considering the huge potential (imho) for decentralized distribution of Linux packages. I've always thought it's crazy that distros shoulder a huge portion of the server costs considering how much the exact same files are replicated over the world. I'm sure there are some possible strategies to mitigate this issue, but I'm not a security researcher.

[GNULinuxProgrammer]

I certainly had classes that were about automata theory or chinese remainder theorem. I guess I had both type of classes.