Why does APT not use HTTPS?

Re:Why does APT not use HTTPS? by DoctorOetker on Monday January 21, 2019 @09:10AM (#18960436)

"everyone" in this context obviously means everyone on the path, and any attackers that have compromised nodes along the path. See the Belgacom hack by 5 eyes...

[ Parent | on HN ]

Re:Why does APT not use HTTPS? by monocasa on Monday January 21, 2019 @01:38PM (#18962397)

And I those attackers can still tell everything based on the target IP and the payload sizes.

[ Parent | on HN ]

Re:Why does APT not use HTTPS? by DoctorOetker on Monday January 21, 2019 @02:49PM (#18963024)

there is no proof that this is true in general, so it is worth trying to find 1) an inefficient way in order to 2) postulate an efficient way...

for example, overlay onion routing, size blurring by appending random length random bits,... with oblivious transfer even the APT-server does not know what you downloaded (but that would require a large amount of information..., nevertheless oblivious transfer might still be a useful tool when used as a primitive, perhaps just to send a list of bootstrap addresses for p2p hosting of the signed files etc...)

[ Parent | on HN ]