How to take over the computer of a Maven Central user

Re:How to take over the computer of a Maven Central user by pjlegato on Monday July 28, 2014 @08:01PM (#8099987)

All of Maven central is only 180gb, according to https://maven.apache.org/guides/mini/guide-mirror-settings.h...

How hard would it be to just mirror it to S3 and use it from there via HTTPS?

[ Parent | on HN ]

Re:How to take over the computer of a Maven Central user by teraflop on Monday July 28, 2014 @08:41PM (#8100103)

That text was last updated in 2010; currently the repository is about 1.1TB.

http://search.maven.org/#stats

[ Parent | on HN ]

Re:How to take over the computer of a Maven Central user by pjlegato on Monday July 28, 2014 @10:24PM (#8100397)

Ack! This does not do anything to increase my confidence in the Maven project's guardianship of our collective security.

[ Parent | on HN ]

Re:How to take over the computer of a Maven Central user by technomancy on Monday July 28, 2014 @08:11PM (#8100023)

> How hard would it be to just mirror it to S3 and use it from there via HTTPS?

Trivial.

Now ask: how hard would it be to pay the bandwidth charges, assuming it were a public bucket. I don't know the answer, but it's a much more interesting question.

[ Parent | on HN ]

Re:How to take over the computer of a Maven Central user by pjlegato on Monday July 28, 2014 @10:23PM (#8100394)

Yes, a very interesting question. It'd be very expensive.

It occurs to me that BitTorrent technically solved the problem of high bandwidth costs long ago; millions of people transfer 1.1TB files around every day without worrying about bandwidth costs at all.

Can we come up with a similar system for jars? Why are we still relying on central servers for this at all?

[ Parent | on HN ]

Re:How to take over the computer of a Maven Central user by cordite on Monday July 28, 2014 @09:52PM (#8100332)

I am guessing with Amazon, even though they run Java, they wouldn't do it out of the good of their hearts.

[ Parent | on HN ]