News for hackers. Stuff that matters.

A comment on Why does APT not use HTTPS?. Parent comment

Re:Why does APT not use HTTPS? by mr__y on Monday January 21, 2019 @01:38PM (#18962399)
> variable length noise Just thinking... could this be achieved by simply adding some extra response headers on the mirror side? That is the response could contain some headers like

   X-Unnecessary-Header-0: [random-string]
   X-Unnecessary-Header-1: [other-random-string]
   ...
This could be enough to insert random-length noise without the need to invent any new protocol. Of course this would only be effective for smaller packages as I assume that headers size is limited and as a result this would significantly change the perceived download size only for smaller packages.
[ Parent | on HN ]
Re:Why does APT not use HTTPS? by DoctorOetker on Monday January 21, 2019 @02:54PM (#18963070)
that might work, and the larger packages might be sent as a sequence of parts, so that essentially all packages have the same size

other things to keep in mind is the dependency graph, some large packages might be rather unique in total filesize downloaded

[ Parent | on HN ]