8 ms·
Mandatory mention of https://whydoesaptnotusehttps.com https://whydoesaptnotusehttps.com
by nicolaslem 8y ago
Mandatory mention of https://whydoesaptnotusehttps.com https://whydoesaptnotusehttps.com
- detaro 8y agoand https://blog.packagecloud.io/eng/2018/02/21/attacks-against-secure-apt-repositories/ https://blog.packagecloud.io/eng/2018/02/21/attacks-against-...
- angry_octet 8y agoAnd yet, it is full of bullshit like this: "HTTPS does not provide meaningful privacy for obtaining packages. As an eavesdropper can usually see which hosts you are contacting, if you connect to your distribution's mirror network it would be fairly obvious that you are downloading updates." The worst sort of neckbeard nonsense. Signatures are if benefit in bandwidth constrained distribution, and for store and forward. Microsoft uses them for package distribution too (x.509 code signing). But there is no doubt that TLS makes interfering much harder. With the move to encrypted SNI and http/2 this will hopefully become moot.