3 ms·

This website does well to present all the relevant questions, but the answers are unconvincing. > But what about privacy? > HTTPS does not provide meaningful

This website does well to present all the relevant questions, but the answers are unconvincing. > But what about privacy? > HTTPS does not provide meaningful privacy for obtaining packages. Subjective/wrong. HTTPS does not provide bulletproof privacy, but as defence in depth (also mentioned later) the privacy offered is always of value. > HTTPS would therefore only be useful for downloading from a server that also offers other packages of similar or identical size. Which sounds exactly like any typically large software repository, no? Even if the use of it slightly decreases the chance of having an easily parsable/cross-referencable listing if packages a user has installed. > Overly trusting CAs This section amounts to a general attack on HTTPS in general, as used on the web. If this were to be followed through, the author would be contending that browsers should stop using HTTPS. > providing a huge worldwide mirror network available over SSL is not only a complicated engineering task "Security is hard, so let's not bother" > it implies a misleading level of security and privacy to end-users as described above. As described where? Nothing previous in the article mentioned users being misled. Unless the implication is that users believe HTTPS hides the host they're visiting. In which case, again, is the author arguing that HTTPS should be deprecated in its entirety. Basically, none of the arguments seem to apply exclusively to apt: they seem general criticisms of HTTPS as a whole. Some are even valid criticisms, but none would convince me to advocate for browsers dropping HTTPS. Apt is not special in this regard.

ksk 9y ago
> Apt is not special in this regard. Well they mentioned it in the tl-dr itself. Apt files are already being checked for tampering. This makes it 'special' compared to regular files being downloaded or content being served. Moving to HTTPS doesn't add any extra layer of security in that regard. Can you articulate what benefits it would bring? >"Security is hard, so let's not bother" When you ship your software, does your bug tracker show zero bugs?
- lucideer 9y ago
  > Apt files are already being checked for tampering. This makes it 'special' compared to regular files being downloaded or content being served. Only if you see HTTPS as a proposed alternative to / replacement for signing. Signing content is of course a great security measure - doing one does not preclude doing both. > Moving to HTTPS doesn't add any extra layer of security in that regard. This is what the article contends. I rebutted this in my comment above. Of course HTTPS should not replace signing, but it does add an extra layer of security. > Can you articulate what benefits it would bring? Firstly, privacy. Not bulletproof, but the article contends that it does not provide "meaningful" privacy which is not true. Secondly, an extra line of defense in addition to signing. As others have commented here, signing is not comprehensive in practice on a per-package basis. > When you ship your software, does your bug tracker show zero bugs? No, but a bug left open in a bug tracker indicates an intent to fix. This one is being marked WONTFIX, which is not OK.
  - ksk 9y ago
    >but the article contends that it does not provide "meaningful" privacy which is not true. Which part is not true? >As others have commented here, signing is not comprehensive in practice on a per-package basis. Great, lets fix that. It is orthogonal to HTTPS. Anything else? >No, but a bug left open in a bug tracker indicates an intent to fix. It also indicates that it did not have a low cost/benefit ratio. >This one is being marked WONTFIX, which is not OK. This point is already addressed under the "Why not provide HTTPS anyway?" section which points to the costs. This indicates strongly that the decision is about cost/benefit. If you have any ideas to lower the costs, propose them. I guess it would first require you to get familiar with all of the ground level logistical details, so maybe an unfair request.

ksk 9y ago

> Apt is not special in this regard. Well they mentioned it in the tl-dr itself. Apt files are already being checked for tampering. This makes it 'special' compared to regular files being downloaded or content being served. Moving to HTTPS doesn't add any extra layer of security in that regard. Can you articulate what benefits it would bring? >"Security is hard, so let's not bother" When you ship your software, does your bug tracker show zero bugs?

lucideer 9y ago
> Apt files are already being checked for tampering. This makes it 'special' compared to regular files being downloaded or content being served. Only if you see HTTPS as a proposed alternative to / replacement for signing. Signing content is of course a great security measure - doing one does not preclude doing both. > Moving to HTTPS doesn't add any extra layer of security in that regard. This is what the article contends. I rebutted this in my comment above. Of course HTTPS should not replace signing, but it does add an extra layer of security. > Can you articulate what benefits it would bring? Firstly, privacy. Not bulletproof, but the article contends that it does not provide "meaningful" privacy which is not true. Secondly, an extra line of defense in addition to signing. As others have commented here, signing is not comprehensive in practice on a per-package basis. > When you ship your software, does your bug tracker show zero bugs? No, but a bug left open in a bug tracker indicates an intent to fix. This one is being marked WONTFIX, which is not OK.
- ksk 9y ago
  >but the article contends that it does not provide "meaningful" privacy which is not true. Which part is not true? >As others have commented here, signing is not comprehensive in practice on a per-package basis. Great, lets fix that. It is orthogonal to HTTPS. Anything else? >No, but a bug left open in a bug tracker indicates an intent to fix. It also indicates that it did not have a low cost/benefit ratio. >This one is being marked WONTFIX, which is not OK. This point is already addressed under the "Why not provide HTTPS anyway?" section which points to the costs. This indicates strongly that the decision is about cost/benefit. If you have any ideas to lower the costs, propose them. I guess it would first require you to get familiar with all of the ground level logistical details, so maybe an unfair request.