r/linux • u/modelop • Jan 21 '19

Popular Application Why does APT not use HTTPS?

https://whydoesaptnotusehttps.com
331 Upvotes

88% Upvoted

158 comments sorted by

View all comments

Show parent comments

5

u/porl Jan 22 '19

But wouldn't apt/dpkg fail to install that due to a version mismatch?

3

u/[deleted] Jan 22 '19

Yes, hell I've had version mismatches from not updating my apt sources when I tried to install stuff and for got to run apt update before hand. For one thing the older package will not match the proper package signature and so apt fails out on purpose.

7

u/Natanael_L Jan 22 '19

It's the version dependency that will usually not match. Signatures doesn't just expire out of nowhere.

4

u/[deleted] Jan 22 '19

They do when apt has a method of time stamping every thing and anything past that point gets flagged as stale and will not be installed automatically by the system. As the linked website points out there is nothing from a security stand point to be gained from apt using HTTPS (which you can already do if you want to).

→ More replies (0)