Re: Can a tracker actively tell clients to stop downloading?

Bill Cox wrote:
> Very interesting idea...  BitTorrent and Yum could be pretty cool.  It
> sounds like a simple enough extension to the tracker response.  Some
> sort of a "move_to" key could do the trick.

There are security issues there.  Right now, the .torrent file is your
secure bit of information.  If you got the .torrent file intact from a
known-good source, then no one can trick your client into downloading
(well, keeping) the wrong thing.  All the tracker can do is go away, and
deny you service.

If you allow the tracker to specify that a torrent has been superceeded
or changed, then it can hand you arbitrary content.

I realize that this isn't a practical problem for a lot of the typical
torrent usages, where random website give you torrent files to random
trackers, and the contents are a crapshoot anyway.  However, it's a
feature that shouldn't be thrown away without some serious consideration.

For example, for your YUM case, you wouldn't want me to be able to DNS
spoof tracker.yum.org, and tell all the clients "no wait, go over here
and get my updated trojaned files instead".

You'd probably have to add on a signing and versioning scheme, so that
there was a trust chain from the original .torrent file to updated ones.

						BB



 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/BitTorrent/

<*> To unsubscribe from this group, send an email to:
    [email protected]

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/