News for hackers. Stuff that matters.

A comment on Why does APT not use HTTPS?. Parent comment

Re:Why does APT not use HTTPS? by q3k on Monday January 21, 2019 @01:06PM (#18962144)
An HTTPS stream can be side-channel (ie size, time) broken down into black-box HTTP/1 requests quite easily. Remember, even with Connection: Keep-alive, you still have to request every file synchronously after you're done with the previous one.
[ Parent | on HN ]
Re:Why does APT not use HTTPS? by loeg on Monday January 21, 2019 @06:26PM (#18964612)
> Remember, even with Connection: Keep-alive, you still have to request every file synchronously after you're done with the previous one.

Wait, why? I don't know of any reason HTTP clients can't pipeline requests.

[ Parent | on HN ]
Re:Why does APT not use HTTPS? by AstralStorm on Tuesday January 22, 2019 @03:08AM (#18966774)
They can but they do not because servers are broken (and terribly so) and it brings less than zero gain for big files.

See, debian does not want to manage specific mirror server features if they don't have to. If they were in that position they'd make their own protocol.

[ Parent | on HN ]
Re:Why does APT not use HTTPS? by loeg on Tuesday January 22, 2019 @01:12PM (#18970617)
Right, that makes sense. So it's not so much a client limitation as a minimum common denominator for their hosting infrastructure.
[ Parent | on HN ]