Re: Q: Use https for {deb,security}.debian.org by default

["Andrew M.A. Cater" <amacater@einval.com>]

On Sat, Aug 21, 2021 at 12:31:26PM +0200, Simon Richter wrote:
> Hi,
> 
> On 21.08.21 10:40, Wouter Verhelst wrote:
> 
> > I've been thinking for a while that we should bake a feature in apt
> > whereby a network administrator can indicate somehow that there is a
> > local apt mirror and that apt should use that one in preference to
> > deb.debian.org.
> 
> I've been thinking the same thing, but that would negate the remaining
> security benefit of using https, that's why I expressed a preference for
> making it visible that the connection is not encrypted and security is only
> provided by the signatures over pretending it is and then (silently?)
> allowing a proxy to intercept the connection.
> 
>    Simon
> 

This is effectively what you do if you specify a non-country mirror in setup
/ specify manually anyway - and that can be preseeded / set up with ansible
or whatever scripting you want to do en masse.

For myself, I'm not convinced that forcing https everywhere will give much
benefit in reality and may impose further complexity / a greater sense of
security without much more real security but if a setting is available
to be overridden when desired, it's not a deal breaker.

All the very best as ever,

Andy Cater