Bug#758316: APT: Use HTTPS by default
On Mon, Dec 29, 2014 at 8:23 PM, Freddy Martinez
<freddymartinez9@gmail.com> wrote:
> Hi Paul,
>
> Thanks you are correct about the http / https in the sources.list.
> But my concern is about security. Downloading binaries over
> unauthenticated connections via HTTP is not good, especially when
> you're downloading security updates. As a project, Debian should
> prioritize mirrors that use HTTPS. I know that is a hard thing to do
> given that most mirrors are run by volunteers at various locations
> (universities, labs etc) but it should be discussed and implemented.
>
> Thanks again,
> Freddy
It does not make sense to use https. All data is authenticated using
GPG signatures. https only offers some encryption on top of that, so
nobody will know which package you are fetching, but that's an
entirely minor issue.
--
Julian Andres Klode - Debian Developer, Ubuntu Member
See http://wiki.debian.org/JulianAndresKlode and http://jak-linux.org/.
Reply to: