News for hackers. Stuff that matters.
Re:Debian apt security update: man-in-the-middle arbitrary c... by dinosaurdynasty on Wednesday November 04, 2026 @11:53AM (#50368324)
> preventing a mitm from knowing what packages you install

Package size is unique enough that just seeing the size of the transfer will usually be enough to tell.

Re:Debian apt security update: man-in-the-middle arbitrary c... by angry_octet on Wednesday November 04, 2026 @04:25PM (#50371791)
Apt uses persistent connections and has multiple requests in flight at once (Acquire::http::Pipeline-Depth). If you acquired the entire history of downloads then you could match it against software updates, and possibly identify by-choice dependency sets, but it would be quite a project.