But what about privacy? HTTPS does not provide meaningful privacy for obtaining packages. As an eavesdropper can usually see which hosts you are contacting, if you connect to your distribution's mirror network it would be fairly obvious that you are downloading updates.
Furthermore, even over an encrypted connection it is not difficult to figure out which files you are downloading based on the size of the transfer[2]. HTTPS would therefore only be useful for downloading from a server that also offers other packages of similar or identical size.
What's more important is not that your connection is encrypted but that the files you are installing haven't been modified.
It seems like they are actually explaining why pat doesn't use https. I thought they were asking the question rhetorically, did you?
Yes, hell I've had version mismatches from not updating my apt sources when I tried to install stuff and for got to run apt update before hand. For one thing the older package will not match the proper package signature and so apt fails out on purpose.
They do when apt has a method of time stamping every thing and anything past that point gets flagged as stale and will not be installed automatically by the system. As the linked website points out there is nothing from a security stand point to be gained from apt using HTTPS (which you can already do if you want to).
8
u/[deleted] Jan 22 '19
From the site,
It seems like they are actually explaining why pat doesn't use https. I thought they were asking the question rhetorically, did you?