Re: Apt sources.list

From	davidson <davidson@freevolt.org>
Newsgroups	linux.debian.user
Subject	Re: Apt sources.list
Date	2023-04-16 02:20 +0200
Message-ID	<GkYhz-2iGI-3@gated-at.bofh.it> (permalink)
References	(4 earlier) <GkPHj-2dFR-5@gated-at.bofh.it> <GkR6p-2eno-11@gated-at.bofh.it> <GkSca-2eYe-5@gated-at.bofh.it> <GkX29-2hMw-3@gated-at.bofh.it> <GkXlv-2i8h-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Sat, 15 Apr 2023 Greg Wooledge wrote:
> On Sat, Apr 15, 2023 at 10:54:10PM +0000, davidson wrote:
>> In case you wish to obscure what software you *install*, but need not
>> conceal the software you *download*:
>>
>>  Step one: Make a list of the packages you want, and then augment it
>>  with as many plausible alternatives and red herrings as you like.
>>
>>  Step two:
>>  $ apt-get -d install <many packages>
>>
>> This downloads the packages only, so you can download packages you
>> will *not* install, along with ones you will. Then install the proper
>> subset you want installed, without the '-d' option.
>
> I'm at a loss as to what threat model this is supposed to protect
> against.

The answer to *that* question was written on the tin.

Instead, you mean to question the existence of actors who *do* care
what some administrator installs, but do not care what they download.

An entirely fair question. Their existence is a logical possibility.
Since you ask, I don't think their presence is inconceivable.

Ritter wrote...

   "It's nice not to be telling everyone who can sniff a plaintext
   connection which packages you are installing"

I consider it an interesting problem.

> In the obvious one ("Comrade Davidson has downloaded package A.  Let's
> bump up the priority of his surveillance."), downloading flagged package A
> *and* possibly-flagged package B is just going to make your situation
> worse, not better.

I explicitly stated, twice (both from the start, and at the conclusion
trimmed by you) that the method does NOT apply to such a threat model.

So here you have helpfully provided a hypothetical narrative to
illustrate a point I wished to make extremely clear.

> Now, personally I don't feel this is a threat model that I need to
> worry about.  I just use plain old http sources at home, and if
> "They" learn that I've downloaded rxvt-unicode and mutt, well, good
> for Them.

We do not seem to be having an argument.

-- 
Hackers are free people. They are like artists. If they are in a good
mood, they get up in the morning and begin painting their pictures.
-- Vladimir Putin

Thread

Apt sources.list <paulf@quillandmouse.com> - 2023-04-15 14:20 +0200
  Re: Apt sources.list Brian <ad44@cityscape.co.uk> - 2023-04-15 14:30 +0200
    Re: Apt sources.list Greg Wooledge <greg@wooledge.org> - 2023-04-15 15:00 +0200
      Re: Apt sources.list Alain D D Williams <addw@phcomp.co.uk> - 2023-04-15 15:40 +0200
        Re: Apt sources.list <tomas@tuxteam.de> - 2023-04-15 15:50 +0200
          Re: Apt sources.list Alain D D Williams <addw@phcomp.co.uk> - 2023-04-15 16:10 +0200
            Re: Apt sources.list <tomas@tuxteam.de> - 2023-04-15 16:20 +0200
        Re: Apt sources.list Brian <ad44@cityscape.co.uk> - 2023-04-15 16:10 +0200
        Re: Apt sources.list Charles Curley <charlescurley@charlescurley.com> - 2023-04-15 16:50 +0200
        Re: Apt sources.list <paulf@quillandmouse.com> - 2023-04-15 17:10 +0200
          Re: Apt sources.list Dan Ritter <dsr@randomstring.org> - 2023-04-15 18:40 +0200
            Re: Apt sources.list <tomas@tuxteam.de> - 2023-04-15 19:50 +0200
              Re: Apt sources.list davidson <davidson@freevolt.org> - 2023-04-16 01:00 +0200
                Re: Apt sources.list Greg Wooledge <greg@wooledge.org> - 2023-04-16 01:20 +0200
                Re: Apt sources.list The Wanderer <wanderer@fastmail.fm> - 2023-04-16 01:30 +0200
                Re: Apt sources.list Stefan Monnier <monnier@iro.umontreal.ca> - 2023-04-16 02:30 +0200
                Re: Apt sources.list davidson <davidson@freevolt.org> - 2023-04-16 02:20 +0200
                Re: Apt sources.list Tim Woodall <debianuser@woodall.me.uk> - 2023-04-16 21:10 +0200
                Re: Apt sources.list Jeffrey Walton <noloader@gmail.com> - 2023-04-16 23:00 +0200
                Re: Apt sources.list Jeffrey Walton <noloader@gmail.com> - 2023-04-17 03:30 +0200
                Re: Apt sources.list <tomas@tuxteam.de> - 2023-04-17 06:50 +0200
                Re: Apt sources.list Jeffrey Walton <noloader@gmail.com> - 2023-04-17 17:10 +0200
                Re: Apt sources.list <tomas@tuxteam.de> - 2023-04-16 07:40 +0200
                Re: Apt sources.list Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2023-04-16 14:10 +0200
          Re: Apt sources.list Alain D D Williams <addw@phcomp.co.uk> - 2023-04-15 20:30 +0200
            Re: Apt sources.list Brian <ad44@cityscape.co.uk> - 2023-04-15 20:40 +0200
            Re: Apt sources.list Andy Smith <andy@strugglers.net> - 2023-04-15 22:00 +0200
          Re: Apt sources.list Charles Curley <charlescurley@charlescurley.com> - 2023-04-15 20:50 +0200
          Re: Apt sources.list Jeffrey Walton <noloader@gmail.com> - 2023-04-16 02:40 +0200
            Re: Apt sources.list <paulf@quillandmouse.com> - 2023-04-16 14:50 +0200
    Re: Apt sources.list <paulf@quillandmouse.com> - 2023-04-15 16:50 +0200
    Re: Apt sources.list "Andrew M.A. Cater" <amacater@einval.com> - 2023-04-15 18:50 +0200
      Re: Apt sources.list Brian <ad44@cityscape.co.uk> - 2023-04-15 21:20 +0200
        Re: Apt sources.list "Andrew M.A. Cater" <amacater@einval.com> - 2023-04-15 22:20 +0200
          Re: Apt sources.list songbird <songbird@anthive.com> - 2023-04-16 00:00 +0200
          Re: Apt sources.list Stefan Monnier <monnier@iro.umontreal.ca> - 2023-04-16 06:20 +0200
            Re: Apt sources.list David Wright <deblis@lionunicorn.co.uk> - 2023-04-16 07:00 +0200
            Re: Apt sources.list "Andrew M.A. Cater" <amacater@einval.com> - 2023-04-16 13:20 +0200
              Re: Apt sources.list Frank <zuiderduin@gmx.com> - 2023-04-16 16:40 +0200
                Re: Apt sources.list John Hasler <john@sugarbit.com> - 2023-04-16 18:20 +0200
          Re: Apt sources.list Frank <zuiderduin@gmx.com> - 2023-04-16 07:20 +0200
            Re: Apt sources.list David Wright <deblis@lionunicorn.co.uk> - 2023-04-16 16:40 +0200
      Re: Apt sources.list <paulf@quillandmouse.com> - 2023-04-15 22:10 +0200
  Re: Apt sources.list Tixy <tixy@yxit.co.uk> - 2023-04-15 18:20 +0200
    Re: Apt sources.list Frank <zuiderduin@gmx.com> - 2023-04-15 22:00 +0200
      Re: Apt sources.list Vincent Lefevre <vincent@vinc17.net> - 2023-04-18 16:40 +0200
        Re: Apt sources.list Frank <zuiderduin@gmx.com> - 2023-04-18 19:50 +0200
          Re: Apt sources.list Jeffrey Walton <noloader@gmail.com> - 2023-04-18 20:00 +0200
            Re: Apt sources.list Vincent Lefevre <vincent@vinc17.net> - 2023-04-20 12:20 +0200
              Re: Apt sources.list Greg Wooledge <greg@wooledge.org> - 2023-04-20 13:30 +0200

csiph-web