3 ms·
Because it doesn't need encryption (packages' contents are public knowledge), while data integrity is protected by GPG digital signatures. That's why.
by dozzie 9y ago
Because it doesn't need encryption (packages' contents are public knowledge), while data integrity is protected by GPG digital signatures. That's why.
- lamby 9y agoDoes the linked page not say this? :)
- fulafel 9y agoIf you see what packages and security updates a host is downloading, you can tell a lot about its role, what the user is doing and what to attack. Consider the high profile case of sysadmin targeting in the Belgacom case. Hypothetically, GCHQ could then easily fingerprint what versions of apps they are using, and use that information in the plan to target that person. (HTTPS is still vulnerable to traffic analysis, but a good client can hamper HTTPS traffic analysis using byte range requests and request pipelining/multiplexing.)