Sorry, but such a strong claim requires more justification. From what I know, it is orders of magnitude harder to hijack a package download over HTTPS than over

Sorry, but such a strong claim requires more justification. From what I know, it is orders of magnitude harder to hijack a package download over HTTPS than over HTTP. It is technically feasible for me to sit in a random coffee shop and do a drive-by infection of .exe files downloaded via HTTP by arbitrary other people on the same WLAN. The same is not true for HTTPS, because I am not able to forge arbitrary SSL certificates. Yes, there are problems with SSL, but to claim that "it doesn't do any good" seems wrong.