Re: [gentoo-dev] (crazy?) proposal to reduce load and disk on mirrors

[bdharring]

On Thursday, July 24, 2003, at 12:54 AM, Raimundo Bilbao wrote:

> On Thu, 24 Jul 2003 09:35:04 +0200
> Håvard Wall <haavardw@×××××××.no> wrote:
>
> [...]
>
>> How about implementing a file-sharing propram taylored for gentoo?
>> Users
>> could voluntarily share their /usr/portage/distfiles, or whatever
>> would
>> benefit mirrors. This would potentially let us keep huge
>> (gaming-)files
>> on their (faulty) hosts. When the original host is down, there would
>> probably already be some users online which have a copy and is
>> sharing it.
>>
> [...]
>
> Sound great, a P2P gentoo (?), but how do you protect against trojans,
> malware and stuffs like that?, is MD5 (AFAIK, currently the only
> checksum used) good enough?.
Famous last words, but if there was a trusted central listing of md5's, 
it is a strong enough hash to identify if the downloaded distfile is 
original or not.
I would guess that it is *possible* to have a different dataset that 
produces an identical md5, but to actually do this isn't even remotely 
feasible, let alone having the code *actually* do something nefarious.
Of course I'm not a cryptologist/mathematician, but suffice it to say 
there is a reason most downloaded sources maintain an md5 sig 
alongside...

I realize this particular horse has been beaten well past it's death, 
but why create a separate p2p system instead of using bit torrent?  
Just curious, I'm aware of how bit torrent is structured, but that's 
about it...
Other then that, you've mentioned that you're attempting a proof of 
concept, care to elaborate on some of the aspects of the particular p2p 
system you're attempting to create/test?
~bdh


--
gentoo-dev@g.o mailing list