John on S8

[John]

Cef wrote:

>>Local mirrors tend to be faster; a day or so ago I was downloading
>>something at 40K bytes/sec on a link capable of ~150.
>>    
>>
>
>Of course, you need to trust your mirror not to be compromised, and you don't 
>want to only rely on the mirror as it may not be updating anymore. I'd be 
>happy if we could retrieve md5sums from both the mirror and the main security 
>repository and compare them before accepting that the files from the mirror 
>are fine, and if they aren't, fall back to the main security repository. This 
>also implies that the files from the mirror also match the md5sums listed. 
>However I'm guessing that this would require a significant rework of apt to 
>achieve, and would not be feasible in the short term. Definitely not in time 
>for warty.
>  
>

Funnily, I don't think the security of security updates is more 
important than the security of the original software. _I_ trust the 
mirrors I use, but then the penalty to me for being wrong isn't so great.

If I trust the nameless crew, why not?

>Also, apt doesn't seem to support rsync as a transport, which would be another 
>way of saving data, perhaps not initially, but definitely in the long run. Of 
>course, that also puts a cpu burden on the machines hosting the files, as 
>rsync is not exactly light on the cpu or memory.
>
>  
>

Also, rsync doesn't get cached by proxies. At least some IAPs have 
transparent proxy in place; I know mine has because I see the headers 
sometimes, and some remote sites seem a little confused about where I am.