3 ms·
No you would not be able to use HTTP/2. HTTP/2 is not implemented in apt, and probably won't be for a very long time, as it directly clashes with apt internals.
by julian-klode 8y ago
No you would not be able to use HTTP/2. HTTP/2 is not implemented in apt, and probably won't be for a very long time, as it directly clashes with apt internals.
That said, pipelining over https is surely possible to, and reduces the risk.
That said, if you're installing security updates automatically, as you should, anyone will know anyway, as there are only about 3-5 possible combinations of updates you'll be downloading on a particular day in one session.
- zaarn 8y agoI'm aware that APT does not use HTTP/2 but it would be able to use it with HTTPS. With automatic security updates, the risk of an attacker finding out what packages you have is less valuable considering you are installing the latest patches. It would be more interesting if that doesn't happen, in which an attacker can learn what you have installed and wait until exploits appear. Automatic updates would negate this attack model. edit: As I've demonstrated in a sibling comment; even 5 packages is already out of scope as solving which packages they are is a task of millenia. If you use 4 it could possibly be done by throwing a supercomputer at it for a few months.