3 ms·
The use of HSTS is a way to suggest to your clients that they use SSL for that domain - for all requests within a time span (which could be "forever"). If anyt
by kchr 8y ago
The use of HSTS is a way to suggest to your clients that they use SSL for that domain - for all requests within a time span (which could be "forever").
If anything, the vendors you mention should be applauded for taking that step towards a more secure distribution of updates. Not enforcing SSL makes malware injection through updates way way easier.
Debian introduced HTTPS repos a while back as an option, but not by default. Other distros already offer it.
- seba_dos1 8y agoDebian, and most other distributions as well, verifies its updates for ages and doesn't need SSL to do that. There are some arguments for using HTTPS anyway, but preventing malware injection isn't one (unless your package manager is exploitable).
- 21 8y agoIt's called defense in depth. Otherwise go ahead and disable DEP, ASLR, and other modern defense in depth and mitigations mechanisms used by Debian, of course, unless your OS is exploitable.