Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.project > #8246
| From | Ben Hutchings <ben@decadent.org.uk> |
|---|---|
| Newsgroups | linux.debian.project |
| Subject | Re: Repository Link are NOT https:// |
| Date | 2015-09-03 20:40 +0200 |
| Message-ID | <q4HAu-3ib-15@gated-at.bofh.it> (permalink) |
| References | <q4GO5-28h-17@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
[Multipart message — attachments visible in raw view] - view raw
On Thu, 2015-09-03 at 19:05 +0200, tom wrote:
> Hi,
>
> I have discovered that non of the repository links is https:// . Is it
> not safer to use only https:// connections.
>
> And as well the download of a debian distro is only http:// .
>
> Sorry to say that but nearly all other distros used for the downlaod
> link https:// . But as repository links they all used only http://
> connections like debian.
It is not necessary to use HTTP-S for authentication of packages:
http://catless.ncl.ac.uk/Risks/28.58.html#subj13.1
If you need to avoid revealing which packages you are downloading, HTTP
-S doesn't do that because it is still possible to observe the length
of each response. In that case you should perhaps use Tor:
http://www.richardhartmann.de/blog/posts/2015/08/25-Tor-enabled_Debian_mirror_part_2/
Ben.
--
Ben Hutchings
Everything should be made as simple as possible, but not simpler.
- Albert Einstein
Back to linux.debian.project | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Repository Link are NOT https:// tom <public-prv@mailueberfall.de> - 2015-09-03 19:50 +0200
Re: Repository Link are NOT https:// Nextime <nextime@nexlab.it> - 2015-09-03 20:00 +0200
Re: Repository Link are NOT https:// Ben Hutchings <ben@decadent.org.uk> - 2015-09-03 20:40 +0200
Re: Repository Link are NOT https:// Florian Weimer <fw@deneb.enyo.de> - 2015-09-03 22:50 +0200
Re: Repository Link are NOT https:// Russ Allbery <rra@debian.org> - 2015-09-04 02:10 +0200
Re: Repository Link are NOT https:// Vincent Bernat <bernat@debian.org> - 2015-09-04 07:30 +0200
Re: Repository Link are NOT https:// Paul Wise <pabs@debian.org> - 2015-09-04 08:50 +0200
csiph-web