<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 03/12/2016 12:49 PM, Denis 'GNUtoo'
Carikli wrote:<br>
</div>
<blockquote cite="mid:20160312184931.1f4a838a@top-laptop"
type="cite"><br>
<pre wrap="">
What are the consequences of that?
- Would people be able to download all their updates this way? Would
there be some torrent mirrors (available 24/24) to make sure of that?</pre>
</blockquote>
<br>
We could use webseeds for this, but due to limitations of bittorrent
it is HTTP only. That is rather insecure overall...<br>
<blockquote cite="mid:20160312184931.1f4a838a@top-laptop"
type="cite">
<pre wrap="">
- Would people be able to get get the latest database in a trusted way? </pre>
</blockquote>
Good question.<br>
<blockquote cite="mid:20160312184931.1f4a838a@top-laptop"
type="cite">
<pre wrap="">
- Is pacman2pacman still sequential, or can it download updates in
parallel?
If it's still sequential, one slow download will block the rest,
dramatically reducing its download speed.
If it's faster, many people would switch to it.
Some people have more than one machine[2] of the same architecture
under parabola, and that result in downloading the updates more than
once.
Transmission claims to support Local Peer discovery[3], but how to
verify that it's actually used when using pacman2pacman?
I didn't succeed in verifying it.
- Security and privacy wise, http(s) works trough Tor. How does that
compares to the encryption on torrents.
Personally I use Tor here to make it harder to attack my computers: a
global attacker monitoring the Internet or a big portion of it would
have a hard time figuring out if an exploit would work since it
wouldn't know in advance which packages are installed and which
version (to know if they are up to date or not).
To contrast that, note that Parabola, and Arch don't have good
policies dealing with building the packages[1].</pre>
</blockquote>
No idea. Transmission does allow for encryption, not sure how good
it is. It is not made for anonymity by nature.<br>
<br>
You brought up some good points. :)<br>
<blockquote cite="mid:20160312184931.1f4a838a@top-laptop"
type="cite">
<pre wrap="">
References:
-----------
[1] We don't have reproducible builds, and, as I understand it,
individual developers upload their binary packages.
Since Arch ships non-free software, this isn't good at all for
security, since their developers probably uses that too.
It also result in a multiple point of failure, any of the developers
might (knowing it or not) upload compromised packages.
Is I understand it, we use many of their packages as-is.
[2] Physical or virtual.
[3] <a class="moz-txt-link-freetext" href="https://en.wikipedia.org/wiki/Local_Peer_Discovery">https://en.wikipedia.org/wiki/Local_Peer_Discovery</a>
Denis.
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Dev@lists.parabola.nu">Dev@lists.parabola.nu</a>
<a class="moz-txt-link-freetext" href="https://lists.parabola.nu/mailman/listinfo/dev">https://lists.parabola.nu/mailman/listinfo/dev</a>
</pre>
</blockquote>
<br>
</body>
</html>