5 ms·
Is that even true? In practice rather than downloading a single package you'd download/update a bunch of packages over the same connection, and an attacker woul
by wallunit 8y ago
Is that even true? In practice rather than downloading a single package you'd download/update a bunch of packages over the same connection, and an attacker would only see the accumulated size, right?
- pvorb 8y agoI'm not sure how APT handles connections, but with a typical browser connections will be reused if requests are made shortly after another. That doesn't mean it's impossible to determine what packages you downloaded. But it will be more effort to do so.
- jlarocco 8y agoYou can see when you run "apt-get install ..." or "apt-get upgrade" that it opens multiple connections to download packages... And the Debian contributor who wrote TFA says it's possible, and I'm sure he knows a lot more about it than I do.