Hacker News new | ask | show | jobs
by akerro 2717 days ago
>unique user ID (UUID) for each installed system that would be sent with DNF mirror-list requests. It explicitly calls out privacy concerns: "We don't want to track; just count."

If Fedora server is compromised they can serve different packages to different users.
2 comments
derefr 2716 days ago
Given that package servers serve packages over HTTP, you can already do this, identifying the user you want to serve different packages by their IP.

However, the packages need to be signed by Fedora for the package manager to accept them, so this has been considered a pretty weak excuse for an "attack" for a while now. "Getting access to code-signing keys allows you to attack the people consuming signed binaries"—wow, you don't say!

link
prolurker 2717 days ago
With control over the mirror list you can prevent certain users from getting updates which is a security problem but without being able to sign packages the danger is limited.
link