3 ms·
Unless it misleads people in to thinking they don't have to check signatures because they fetched it over HTTPS which is "secure"
by admax88q 8y ago
Unless it misleads people in to thinking they don't have to check signatures because they fetched it over HTTPS which is "secure"
- bigiain 8y agoAlso, as the article posts out - it's not exactly trivial to deploy https across their global mirror network or to make it work with local caching proxies. That's an easy thing if you've got a handful of servers or a few load balancers, but not so easy or practical for their use case. (Also, remember most of the apt development had already happened way before free ssl certs became a thing. While saying "Why don't then just use certbot/LetEncrypt is an easy criticism, give them credit for having actually build a GPG sig secured distributed software delivery system years before LetEncrypt existed...)