[tor-bugs] #13154 [- Select a component]: Debian's "popularity contest" package as threat vector?

[Tor Bug Tracker & Wiki]

#13154: Debian's "popularity contest" package as threat vector?
--------------------------------------+------------------------------------
     Reporter:  saint                 |      Owner:
         Type:  enhancement           |     Status:  new
     Priority:  normal                |  Milestone:
    Component:  - Select a component  |    Version:
   Resolution:                        |   Keywords:  tor-hs, Debian, Stormy
Actual Points:                        |  Parent ID:
       Points:                        |
--------------------------------------+------------------------------------

Comment (by cypherpunks):

 Good call!

 It would be awesome if popcon used tor when it found it installed. But
 since that won't happen anytime soon, I think it is reasonable to list it
 in the Conflicts line of Stormy's debian package.

 Btw, what do you mean by "install process"? I'm assuming there will be a
 debian package, otherwise popcon wouldn't be an issue... but, removing the
 package in stormy's preinst or postinst script isn't possible, I think,
 because dpkg is still running.

 You could make Stormy refuse to start if popcon is installed, but it could
 narc you out before you fix the problem so that isn't the right approach.
 If you want to make sure popcon never reports Stormy, I think using the
 Conflicts line is the only way to do it.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13154#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online