[tor-bugs] #13154 [- Select a component]: Debian's "popularity contest" package as threat vector?

[Tor Bug Tracker & Wiki]

#13154: Debian's "popularity contest" package as threat vector?
--------------------------------------+------------------------------------
     Reporter:  saint                 |      Owner:  saint
         Type:  enhancement           |     Status:  accepted
     Priority:  normal                |  Milestone:
    Component:  - Select a component  |    Version:
   Resolution:                        |   Keywords:  tor-hs, Debian, Stormy
Actual Points:                        |  Parent ID:
       Points:                        |
--------------------------------------+------------------------------------

Comment (by saint):

 Replying to [comment:1 cypherpunks]:
 > Btw, what do you mean by "install process"? I'm assuming there will be a
 debian package, otherwise popcon wouldn't be an issue... but, removing the
 package in stormy's preinst or postinst script isn't possible, I think,
 because dpkg is still running.

 After install, you must run stormy in order to set up a hidden service
 with it.  During HS setup, it adds other packages and adjusts various
 configurations.

 > You could make Stormy refuse to start if popcon is installed, but it
 could narc you out before you fix the problem so that isn't the right
 approach.

 It would *definitely* narc you out if Stormy had been installed through
 debian, but not configured (such as before Stormy is ever run).  This is
 definitely a concern, as someone could install the application but not set
 up their hidden service for a while.

 > If you want to make sure popcon never reports Stormy, I think using the
 Conflicts line is the only way to do it.

 Thanks!

 > It does at least encrypt the reports it sends back, though.

 The FAQ says that they "evaluate" using public key encryption.
 http://popcon.debian.org doesn't even use SSL.  Although it does seem like
 it might be possible to run it through Tor *if* its mail function is
 disabled.

 The Tails team also had a good discussion about why it was disabled by
 default: https://mailman.boum.org/pipermail/tails-
 dev/2012-October/001960.html

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13154#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online