> Read the HTTP request payload The thing to note here is that the only reason this seems easy is that there is tooling readily available for such a task. If y

> Read the HTTP request payload The thing to note here is that the only reason this seems easy is that there is tooling readily available for such a task. If you didn't have such tooling, you'd find it more difficult to implement then your HTTPS case even _with_ tooling. The same principle applies to your HTTPS case. Your argument disappears as soon as there is tooling. That tooling only needs to be written once. Perhaps it already has been done and exists in the circles where people want to surveil apt users. One possible reason such tooling isn't widely available is that apt doesn't use HTTPS by default, and one outcome may be that if apt switched to HTTPS the tooling would appear. I have half a mind to write the tooling and publish it just to eliminate this argument. It really isn't very difficult.