[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#992692: general: Use https for {deb,security}.debian.org by default

Hi,

On 10.09.21 01:46, Paul Wise wrote:


Another important argument is that it creates a dependency on
third-party commercial CDNs, and their *continued* sponsorship.



This dependency on external providers is unavoidable, Debian
definitely cannot afford to run our own CDN at the scale needed to
support our existing userbase. For example the security mirrors
struggled with Linux kernel security updates, so security.d.o switched
to a commercial CDN. Also, we are dependent on continued sponsorship
for all of our infrastructure, paying for all of our hosting is likely
not feasible.
Yes -- and mirrors have traditionally been provided by third parties. What is new about the CDNs is that there are rather few of those, and this centralization aspect is what worries me. 


Personally I'd like to see a larger variety of Debian delivery
mechanisms; copy Debian/snapshot to archive.org, create a multi-distro
FLOSS CDN, bring back httpredir, DebTorrent and apt-p2p, add an i2p
mirror, use IPFS and content oriented networking etc. Michael Stone's
apt://debian idea seems like a good way to move in that direction
while adding protocol agility.
Yes, absolutely -- and we especially want to have a better solution for containers, because my expectation is that a large fraction of our traffic is just people not bothering to set up caching. 

   Simon
Reply to: