<story><title>Why does APT not use HTTPS?</title><url>https://whydoesaptnotusehttps.com/</url></story><parent_chain><item><author>hannob</author><text>I guess I can copy over a comment I made when this previously made rounds:&lt;p&gt;I have a few problems with this. The short summary of these claims is “APT checks signatures, therefore downloads for APT don’t need to be HTTPS”.&lt;p&gt;The whole argument relies on the idea that APT is the only client that will ever download content from these hosts. This is however not true. Packages can be manually downloaded from packages.debian.org and they reference the same insecure mirrors. At the very least Debian should make sure that there are a few HTTPS mirrors that they use for the direct download links.&lt;p&gt;Furthermore Debian also provides ISO downloads over the same HTTP mirrors, which are also not automatically checked. While they can theoretically be checked with PGP signatures it is wishful thinking to assume everyone will do that.&lt;p&gt;Finally the chapter about CAs and TLS is - sorry - baseless fearmongering. Yeah, there are problems with CAs, but deducing from that that “HTTPS provides little-to-no protection against a targeted attack on your distribution’s mirror network” is, to put it mildly, nonsense. Compromising a CA is not trivial and due to CT it’s almost certain that such an attempt will be uncovered later. The CA ecosystem has improved a lot in recent years, please update your views accordingly.</text></item></parent_chain><comment><author>omarforgotpwd</author><text>The other big problem is that people can see what you&amp;#x27;re downloading. Might not be a big deal but consider:&lt;p&gt;1. You&amp;#x27;re in China and you download some VPN software over APT. A seemingly innocuous call to package server is now a clear violation of Chinese law.&lt;p&gt;2. Even in the US, can leak all kinds of information about your work habits, what you&amp;#x27;re working on, etc.&lt;p&gt;3. If it&amp;#x27;s running on a server, it could leak what vulnerable software you have installed or what versions of various packages you&amp;#x27;re running to make exploiting known vulnerabilities easier</text></comment>
<story><title>Why does APT not use HTTPS?</title><url>https://whydoesaptnotusehttps.com/</url></story><parent_chain><item><author>hannob</author><text>I guess I can copy over a comment I made when this previously made rounds:&lt;p&gt;I have a few problems with this. The short summary of these claims is “APT checks signatures, therefore downloads for APT don’t need to be HTTPS”.&lt;p&gt;The whole argument relies on the idea that APT is the only client that will ever download content from these hosts. This is however not true. Packages can be manually downloaded from packages.debian.org and they reference the same insecure mirrors. At the very least Debian should make sure that there are a few HTTPS mirrors that they use for the direct download links.&lt;p&gt;Furthermore Debian also provides ISO downloads over the same HTTP mirrors, which are also not automatically checked. While they can theoretically be checked with PGP signatures it is wishful thinking to assume everyone will do that.&lt;p&gt;Finally the chapter about CAs and TLS is - sorry - baseless fearmongering. Yeah, there are problems with CAs, but deducing from that that “HTTPS provides little-to-no protection against a targeted attack on your distribution’s mirror network” is, to put it mildly, nonsense. Compromising a CA is not trivial and due to CT it’s almost certain that such an attempt will be uncovered later. The CA ecosystem has improved a lot in recent years, please update your views accordingly.</text></item></parent_chain><comment><author>hacknat</author><text>Also, their claim that HTTPS doesn’t hide the hosts that you are visiting is about to not be true. Encrypted SNI is now part of the TLS 1.3 RFC, so HTTPS will actually hide one’s internet browsing habits quite well. The only holes in privacy left on the web’s stack are in DNS.</text></comment>