Hacker News Reader

> preventing a mitm from knowing what packages you install

Package size is unique enough that just seeing the size of the transfer will usually be enough to tell.

Apt uses persistent connections and has multiple requests in flight at once (Acquire::http::Pipeline-Depth). If you acquired the entire history of downloads then you could match it against software updates, and possibly identify by-choice dependency sets, but it would be quite a project.

Reply on news.ycombinator.com