Re: Repository Link are NOT https://
tom <public-prv@mailueberfall.de> writes:
> I have discovered that non of the repository links is https:// . Is it
> not safer to use only https:// connections.
> And as well the download of a debian distro is only http:// .
> Sorry to say that but nearly all other distros used for the downlaod
> link https:// . But as repository links they all used only http://
> connections like debian.
It doesn't matter for the integrity of the packages. APT does a much
stronger validation via a public key signature and doesn't rely on
transport security at all.
It does potentially matter as a source of information leakage, since it
allows others to know what packages you're downloading to your host.
Unfortunately, it's hard for us to deploy a consistent certificate through
our entire mirror network, so it's a bit of a challenge to enable TLS for
package downloads. It's also not clear that encrypting the package
download channel actually buys you much in terms of privacy, since an
attacker can still do quite a lot by correlating the amount of traffic
with the sizes of packages.
--
Russ Allbery (rra@debian.org) <http://www.eyrie.org/~eagle/>
Reply to: