News for hackers. Stuff that matters.
Re:Why does APT not use HTTPS? by peterwwillis on Monday January 21, 2019 @10:36AM (#18961014)
Wouldn't help. If almost all of the files' sizes are unique (I'm pretty sure compressed package sizes aren't even block-aligned), and you know the sizes ahead of time, and you can make test requests for samples of what headers are being sent/received, it's trivial to calculate which combination of packages would result in a given stream length using pipelining. You'd have to add countermeasures like padding or fake data.

There are no comments on this comment yet.