Why does APT not use HTTPS?

Re:Why does APT not use HTTPS? by kstrauser on Monday January 21, 2019 @12:38PM (#18961946)

When I say `apt-get install foo` and it brings in 47 other packages, the problem gets exponentially more difficult. "He downloaded 1,432,509,104 bytes; what packages were those?" is more or less O(2^n): https://en.wikipedia.org/wiki/Knapsack_problem

If you download exactly one package, it may be easy to deduce which one it was (assuming that the protocol overhead is identical each time, and that changing timestamps and nonces doesn't affect the byte length whatsoever, etc.). If you download more than one at a time, which is common with Debian, then the problem is a whole lot harder.

[ Parent | on HN ]

Re:Why does APT not use HTTPS? by q3k on Monday January 21, 2019 @01:06PM (#18962144)

An HTTPS stream can be side-channel (ie size, time) broken down into black-box HTTP/1 requests quite easily. Remember, even with Connection: Keep-alive, you still have to request every file synchronously after you're done with the previous one.

[ Parent | on HN ]

Re:Why does APT not use HTTPS? by loeg on Monday January 21, 2019 @06:26PM (#18964612)

> Remember, even with Connection: Keep-alive, you still have to request every file synchronously after you're done with the previous one.

Wait, why? I don't know of any reason HTTP clients can't pipeline requests.

[ Parent | on HN ]

Re:Why does APT not use HTTPS? by AstralStorm on Tuesday January 22, 2019 @03:08AM (#18966774)

They can but they do not because servers are broken (and terribly so) and it brings less than zero gain for big files.

See, debian does not want to manage specific mirror server features if they don't have to. If they were in that position they'd make their own protocol.

[ Parent | on HN ]

Re:Why does APT not use HTTPS? by loeg on Tuesday January 22, 2019 @01:12PM (#18970617)

Right, that makes sense. So it's not so much a client limitation as a minimum common denominator for their hosting infrastructure.

[ Parent | on HN ]