Re: Apt sources.list

[Greg Wooledge <greg@wooledge.org>]

On Sat, Apr 15, 2023 at 10:54:10PM +0000, davidson wrote:
> In case you wish to obscure what software you *install*, but need not
> conceal the software you *download*:
> 
>  Step one: Make a list of the packages you want, and then augment it
>  with as many plausible alternatives and red herrings as you like.
> 
>  Step two:
>  $ apt-get -d install <many packages>
> 
> This downloads the packages only, so you can download packages you
> will *not* install, along with ones you will. Then install the proper
> subset you want installed, without the '-d' option.

I'm at a loss as to what threat model this is supposed to protect against.
In the obvious one ("Comrade Davidson has downloaded package A.  Let's
bump up the priority of his surveillance."), downloading flagged package A
*and* possibly-flagged package B is just going to make your situation
worse, not better.

Now, personally I don't feel this is a threat model that I need to
worry about.  I just use plain old http sources at home, and if "They"
learn that I've downloaded rxvt-unicode and mutt, well, good for Them.