TAP 19: should discuss privacy

Open
#178 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
32/100
Issue type
Documentation
Clarity
Mostly clear
Activity status
Stale
Domain
documentation, security

Research direction

Read TAP 19 first, then review the passim and fwupd privacy context described in this issue. Document how content-addressable storage can reveal downloads to untrusted participants, and compare that exposure with traditional TUF; the TAP is done when these privacy implications are clearly discussed.

Written by the indexing model from the issue text.

Description

While I was readin up on passim (a mDNS based content addressable storage) I noticed that their main use case fwupd does not use passim for artifact downloads because of privacy reasons: They don't want the other download "source" (which is potentially untrusted) to know which firmware files get downloaded.

I think TAP 19 should discuss the privacy implications as well: I think they exist in some form for all content addressable storage where the participants are not completely trusted (in comparison to traditional TUF where the privacy leak happens only to the relatively more trusted TUF artifact repository).

Dominant language
No language data
Stars
37
Forks
23
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from theupdateframework/taps

All issues in theupdateframework/taps

Similar issues

More Documentation issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.