Philipp Kern <pkern@debian.org> writes: > Hi, > > On 11/18/24 5:25 PM, Linus Nordberg wrote: >> I think that users connecting to https://snapshot.debian.org/ should >> expect the information about what packages they are interested in to >> stay between them and Debian. > > Do they? We are serving deb.debian.org, planet.debian.org, > archive.debian.org, metadata.ftp-master.debian.org, > security-tracker.debian.org, and security.debian.org(!) behind Fastly > already. We are also only collecting at most sampled logs from these > services[1]. Indeed some of the problems could be resolve by naming things appropriately, and offering long-term stable names. A suggestion: snapshot.debian.org -> CDN-of-choice-for-debian, consistent with Philipp's observation above. snapshot-fastly.debian.org -> Fastly CDN, already exists snapshot-cloudflare.debian.org -> Cloudflare CDN, already exists snapshot-real.debian.org -> goes it Debian-maintained HTTPS server Of course replace with your own preference for "-real". I believe that the usage and privacy policy of most CDN's are generally incompatible with Debian's goals, and one reason this hasn't hit the fan is because the usage and privacy policy's are not documented properly. So nobody even knows what usage and privacy policy they are using when accessing for example https://archive.debian.org/ Presumably the usage policy is something along the line of "we'll happily substitute libcrypto3-udeb_3.0.14-1~deb12u2_arm64.udeb with a compromised version for some particular IP/User-Agent's if someone calls us and asks nicely and offers an invoicing opportunity". /Simon
Attachment:
signature.asc
Description: PGP signature