4 ms·
The argument would be that it's easier to see what someone is downloading (and thus infer installing) by sniffing the http traffic rather than https Sure you c
by iso1631 4y ago
The argument would be that it's easier to see what someone is downloading (and thus infer installing) by sniffing the http traffic rather than https
Sure you can do some form of fingerprinting with request sizes over https, but that's another step and no guarentee (which of two identical length files did they get for example)
What the risk is to this information is another matter.
- sgtcodfish 4y agoHaving the communication in cleartext also makes it much easier for attackers to interfere with! Sure, they can't modify the .deb without failing signature verification, but they _can_ inject arbitrary delays in downloads or interfere with anything else which isn't signed (e.g. HTTP headers) Plus, if a vulnerability was discovered in the signing tool which enabled signature verification bypass with a certain signature format, HTTP makes it easy for attackers to perform that attack. TLS shouldn't be optional for installing packages today IMO - the extra guarantees it provides are worth it even with signature verification enabled.