Why does APT not use HTTPS?

Re:Why does APT not use HTTPS? by yrf on Monday January 21, 2019 @05:02AM (#18959181)

infosec twitter is crap like any other twitter subculture, full of drama queens and clickbait to increase their fav/rt count. What's even sadder is that they make no money off it.

[ Parent | on HN ]

Re:Why does APT not use HTTPS? by eqqn on Monday January 21, 2019 @07:17AM (#18959839)

Indeed, something similar happened just last week. theHacker News(not to be confused with HN) twitter lashed out at VLC for not updating over https, which essentially uses same(ish?) code signing as described by APT. A bit of a shit show.

[ Parent | on HN ]

Re:Why does APT not use HTTPS? by detaro on Monday January 21, 2019 @11:03AM (#18961202)

HN also had a big thread participating in the fray...

I'm seriously tempted to start flagging links that point to "bad"/"outrage" bugtracker decisions like this, wide public distribution seems to make things quite a bit worse.

[ Parent | on HN ]

Re:Why does APT not use HTTPS? by dcbadacd on Monday January 21, 2019 @08:51PM (#18965347)

They use 1024bit DSA with SHA1, it is not cryptographically secure! Thus they would really benefit from HTTPS, it would provide another layer of protection against tampering.

Oh and we haven't even addressed that their "secure signing" doesn't also protect first installs that could be insecurely downloaded.

[ Parent | on HN ]

Re:Why does APT not use HTTPS? by AstralStorm on Tuesday January 22, 2019 @03:32AM (#18966860)

Most Debian mirrors support https. But HTTPS alone does not help you vs fresh connection if it is a rotating certificate like Lets Encrypt that has a dubious authentication chain.

Egypt or Turkey can issue valid fake certificates so you would have to check it if it's not one of those.

[ Parent | on HN ]