Hacker News Reader

Comment by spookie | Hacker News Reader

At the end of the day, there's a trust issue. The way distribution works nowadays, mitigates a lot of those. Making it decentralised would be a step backwards.

View on HN

Aren't the RPMs signed?

Packages can be and generally are signed and verified.

You know that packages are signed right? That's why everyone can be a libreoffice or ArchLinux Mirror...or Fedora?

And because of this, these mirrors are often non https so your ISP can actually intercept and provide the data to you directly.

This is why torrents would actually work fine in this model.

>ISP can actually intercept and provide the data to you directly

What a nice gesture! However my mirror-servers are https plus rsync (for some projects). But are there not some ISP's that block torrent-traffic completely?

BitTorrent is hard to block completely from my understanding of how the protocol works, but I may be wrong.

Unless you can break the SHA1 hashes for the torrent chunks and the global hash torrents also authenticate the content. If you have a valid "info" dictionary at least.

Where intercept usually means point DNS for the mirror domains to the ISP's local mirror, and ISP could mean your cloud provider.

A digital signature does not protect you against a malicious actor who starts distributing outdated, vulnerable versions to you.

How do i know you don't know what your talking about?....a mystery ;)

I mean replay attack and freeze attack as described in https://doi.org/10.1145/1455770.1455841 . It's very likely that I'm not up to date on mitigations in individual package managers.

>all of these package managers have vulnerabilities that can be exploited by a man-in-the-middle or a malicious mirror.

Well, that's how software is, but that article is from 2008 and things have gotten a lot better in the meantime (I think archlinux wasn't even signing their packages back then).

If the distribution's private keyring isn't compromised and you don't have third-party repos, your packages are as trustworthy as your distribution team (and upstream).

Reply on news.ycombinator.com