3 ms·

But the watchmen can still see you connect to the IP address of yourfavoritelinux.org or its mirror. And then they can see you transfer approximately a distro

by clarry 10y ago

But the watchmen can still see you connect to the IP address of yourfavoritelinux.org or its mirror. And then they can see you transfer approximately a distro image sized chunk of data. Perhaps you just downloaded your favorite linux distro? I argue that the privacy provided is minimal, and for real privacy, you'll have to find something like tor (not an endorsement of it) or alternative, anonymous channels... As for authentication, yes, it is quite minimal. So HTTPS doesn't solve any problem well (meanwhile introducing some of its own problems). The better solutions to these problems make HTTPS wholly unnecessary. I find the fixation on HTTPS bizarre, even concerning. Would the author have written this piece if all distros ticked all the three HTTPS boxes? Would he then no longer consider the state of things sad? That would be dangerous. That would be alarming. I hate the "false sense of security" argument that people apply to just about anything these days.. but this would be it.

nitrogen 10y ago
I find the anti-HTTPS fixation equally bizarre. There are lots of approximately image-sized files one might download, so simply knowing that "IP X transferred 700MB of data from IP Y" is not the same as knowing that "IP X downloaded CentOS from IP Y, therefore target IP X with CentOS-specific attacks".
- xorcist 10y ago
  > I find the anti-HTTPS fixation equally bizarre Nobody is anti-https here. The point is that it does doesn't protect against software distribution integrity (especially not when mirrors and CDNs are used). Pretending that security would improve with https risks making the problem worse, not better. What's needed is better instructions how to verify integrity included with the installation instructions.
Aaron1011 10y ago
What problems does HTTPS introduce (besides a potential for a false sense of security)? "Better solutions" (excluding the anonymity aspect) such as GPG signatures still require that you trust the key fingerprint used to sign the hash. That's not necessarily any more trustworthy than an HTTPS certificate, especially for someone who hasn't downloaded the ISO before. "Would the author have written this piece if all distros ticked all the three HTTPS boxes?" Most likely, as three of the criteria listed have nothing to do with HTTPS ("Checksum available", "GPG signature available", and "Verification instructions clear and easy to find").

by clarry 10y ago

nitrogen 10y ago

I find the anti-HTTPS fixation equally bizarre. There are lots of approximately image-sized files one might download, so simply knowing that "IP X transferred 700MB of data from IP Y" is not the same as knowing that "IP X downloaded CentOS from IP Y, therefore target IP X with CentOS-specific attacks".

xorcist 10y ago
> I find the anti-HTTPS fixation equally bizarre Nobody is anti-https here. The point is that it does doesn't protect against software distribution integrity (especially not when mirrors and CDNs are used). Pretending that security would improve with https risks making the problem worse, not better. What's needed is better instructions how to verify integrity included with the installation instructions.

Aaron1011 10y ago

What problems does HTTPS introduce (besides a potential for a false sense of security)? "Better solutions" (excluding the anonymity aspect) such as GPG signatures still require that you trust the key fingerprint used to sign the hash. That's not necessarily any more trustworthy than an HTTPS certificate, especially for someone who hasn't downloaded the ISO before. "Would the author have written this piece if all distros ticked all the three HTTPS boxes?" Most likely, as three of the criteria listed have nothing to do with HTTPS ("Checksum available", "GPG signature available", and "Verification instructions clear and easy to find").