Why does APT not use HTTPS?

Re:Why does APT not use HTTPS? by marcosdumay on Monday January 21, 2019 @10:31AM (#18960976)

> can we design a package distribution system that preserves privacy against nation state level actors?

That's a great question. Also, can we do it on top of the current Debian infrastructure (HTTP and everything)? Or do we need to change anything?

[ Parent | on HN ]

Re:Why does APT not use HTTPS? by brazzy on Monday January 21, 2019 @11:12AM (#18961279)

> Also, can we do it on top of the current Debian infrastructure (HTTP and everything)?

I'm pretty sure that is not possible, because the current infrastructure is just plain old HTTP file servers (anything that can sling bits will do) run by whoever fancies being a part of it.

[ Parent | on HN ]

Re:Why does APT not use HTTPS? by marcosdumay on Monday January 21, 2019 @11:23AM (#18961364)

If you create an onion layer like the GP proposes, I don't see any loss from it running over HTTP servers.

[ Parent | on HN ]

Re:Why does APT not use HTTPS? by xorcist on Monday January 21, 2019 @04:18PM (#18963716)

It already exists. It's called tor.

But the question here was why https isn't default in apt, not why tor isn't.

[ Parent | on HN ]

Re:Why does APT not use HTTPS? by DoctorOetker on Tuesday January 22, 2019 @12:40AM (#18966228)

you're replying downstream of my comment containing "for me the real interesting question is:..." where I generalized the question away from the false dichotomy "keep apt as it is, or make https default in apt"

[ Parent | on HN ]