hi, [@u: I'd like to decide on a strategy by February 25, so if we decide to go find a very specific kind of mirrors we have time to do this by the end of March.]
sajolida wrote (13 Feb 2016 12:49:46 GMT) : > The only other issue I see that relates to my work on the assistant, is > the fallback solution outside of DAVE so maybe that's off-topic here. Just a tiny bit :) Retitled this sub-thread accordingly. > From the blueprint I wonder whether it's really worth writing a version > of the JavaScript that works outside of DAVE. Thanks for raising this topic! I was wondering too. > You're considering several > cases outside of DAVE and BitTorrent: > A. Release candidates. We're discussing in another thread the > possibility of only relying on archive.torproject.org > for these. I think we need HTTPS there so your JavaScript > outside of DAVE might not be enough to replace this here. Sounds like a pretty simple matter of programming to me. Our new mirror pool design allows us to point to TLS-enabled (HTTPS) mirrors. I guess it would be easy to give the JS function a boolean argument that specifies whether non-TLS mirrors shall be used, and on calls for testing we can use that to pick a mirror among the ones the TLS-enabled ones only. Also note that my secret plan is to leverage this new mirror pool design to transition to TLS-enabled downloads only. With Let's Encrypt around, plus us allowing mirrors to use whatever virtualhost name they want, it looks like this could finally happen :) > B. People with no JavaScript, wget, etc. It seems like we need the > minimal DNS pool if we want to support these anyway. Sure, we will need this pool anyway. But the less we rely on that DNS pool, the better: the less load we put on it (i.e. the less users we send to it), the more reliable it is, and the less daily maintenance effort is required. This is especially true until we have recruited very fast and reliable mirrors to put into this pool. Now, indeed it may be more worth our time to go after such new mirrors, than writing code to workaround the lack thereof :) > C. Direct download link, as proposed on #11024. These people > should anyway be able to do OpenPGP verification on their own so it > won't be advertised very prominently and maybe the minimal DNS pool > you are proposing for (B) could be reused here. Also, having a > constant URL might be nice for these people to bookmark it for > example. Right, and same answer as for B. Let's add to this: D. Users of web browsers that DAVE does not support ... which is similar to B and C the way I see it. So, all in all: I'm now tempted to invest time into looking for a few very reliable and fast mirrors, and put aside the "dynamic mirror URL picked with JS outside of DAVE" idea for now. We can always come back to it, if the mirrors recruitment is not successful enough: we already have code that basically does the job, so it shouldn't be a big deal to switch back to this option at the last minute, if required. Thoughts, opinions? Cheers, -- intrigeri _______________________________________________ Tails-dev mailing list Tails-dev@boum.org https://mailman.boum.org/listinfo/tails-dev To unsubscribe from this list, send an empty email to tails-dev-unsubscr...@boum.org.