Re: Accessing security.debian.org through https
Hi.
On Sat, Apr 18, 2020 at 06:48:59PM +0100, André Rodier wrote:
> I am investigating the option to enforce https access on my network,
> and I am surprised I have no way to access security.debian.org.
Technically, you can: https://deb.debian.org/debian-security
Not that using it will not be useful in any way as currently it just
serves an HTTP redirect to http://security.debian.org
> Is there any reason why https is not supported (yet?),
1) HTTPS vs HTTP is noticeable in terms of server load, especially if
the whole world tries to get the same package at the same time.
2) Release files are GPG signed, and contain multiple checksums for
every package served.
A package (or a Release) that's substituted by a third party will be
noticed by a local apt (so integrity is here), and confidentiality is
not an issue here.
> especially with lets-encrypt.
They use certificates signed by this CA already if it's appropriate
(deb.d.o, wiki.d.o, www.d.o to name a few).
Reco
Reply to: