That was the main reason why it got pawned few months ago. All main sources are using HTTP, it comes as default. It's your responsibility to make it https. Most

That was the main reason why it got pawned few months ago. All main sources are using HTTP, it comes as default. It's your responsibility to make it https. Most of the distros are using HTTP by default except a few that respect privacy and security. https://www.theregister.co.uk/2019/01/22/debian_package_manager_flaws/ https://www.theregister.co.uk/2019/01/22/debian_package_mana... https://whydoesaptnotusehttps.com https://whydoesaptnotusehttps.com