4 ms·
the reason why apt (and I assume apk) don't use SSL has nothing to do with the CPU https://whydoesaptnotusehttps.com/ https://whydoesaptnotusehttps.com/
by flatiron 8y ago
the reason why apt (and I assume apk) don't use SSL has nothing to do with the CPU
https://whydoesaptnotusehttps.com/ https://whydoesaptnotusehttps.com/
- wolf550e 8y agoI'm just replying to "Serving large amounts of content over HTTPS is expensive".
- Groxx 8y ago>HTTPS does not provide meaningful privacy for obtaining packages. As an eavesdropper can usually see which hosts you are contacting, if you connect to your distribution's mirror network it would be fairly obvious that you are downloading updates. This assumes that package hosts segregate themselves by all possible privacy-related dimensions. They don't. If you host illegal-in-country-X content on AWS and someone downloads it there, HTTPS would've prevented that from being seen. HTTP does not. --- HTTPS belongs everywhere. It has flaws, of course, but there's no reasonable alternative at the moment. You can't predict what governments will decide in the future, and HTTP-now means they can record it and apply rules retroactively if they change their mind. This kind of thing gets people killed.