final release - p2p or mirrors
Jim Cornette
redhat-jc at insight.rr.com
Sat May 15 21:33:50 UTC 2004
Eugen Leitl wrote:
> On Sat, May 15, 2004 at 02:52:42PM -0400, Jim Cornette wrote:
>
>
>>I still feel uncomfortable with p2p transfers. Also, I don't like the
>
>
> You shouldn't. The integrity is asserted by the transport layer, you shall
> of course check digital signatures to assert you're downloading the genuine
> thing (if you're paranoid that way, I personally don't bother to check at
> this yellow-green threat level).
I was thinking in reference to someone posting about a high
fragmentation level on a bittorrent acquired iso. I was also thinking
that bittorrent used bits and pieces of files available. I never thought
about tcp/ip delivering packets. I assumed that the files on mirrors
would be streamed consecutively. (keeps stream of data first to last on
file being downloaded.)
Having a pool of computers grabbing some info from one user and some
more bits from another source, then another source seems a little too
open for foul play.
I'm not so paranoid that I'd need to digitally verify data from the
mirrors hosting Fedora. Thanks for pointing out that this could be
spoofed also. I felt a false level of security, safer (IMHO), but not
super secure.
>
>
>>idea of getting the download in fragments and then reconstructed. I
>
>
> TCP/IP does that, too. Are you uncomfortable with reading this mail as well?
Thanks for pointing out the packets from tcp/ip. I am not uncomfortable
getting mail, etc. (yet)
>
>
>>would rather get transfers from mirrors with a pretty good reputation,
>>instead of a bits and pieces download and reconstructed files.
>
>
> If you want reputation tracking, use digital signatures to validate authenticity.
> Anything else is easily fakeable.
Sounds like a wise practice.
>
>
>>>Personally, I usually grab a copy via bittorrent and then give it to our
>>>local mirror.
>
>
> I personally much prefer to torrent, and leave the download session open for
> at least a day, just to be a good bittorrentcitizen.
>
> I only use http/ftp mirrors for those more braindead distributions who're not
> into the wonders of P2P yet (hello? Debian? what gives?).
>
>
Jim
More information about the fedora-test-list
mailing list