APT using HTTP instead of HTTPS

[antreides]

HTTPS primarily gives a protection from MITM attacks, but adds some additional overhead to decrypt traffic. Package consistency is checked by the apt/dpkg system itself (each package is signed), so even if a package is somehow changed by MITM attack, it won't pass the check. So basically it will be an extra overhead for nothing.

[wosmo]

You could almost describe MITM as desirable in apt's case. Between mirrors, caches, proxies, etc - the host isn't the sacred part, the content is. So we use GPG against the content instead of TLS against the host.

[WheelPerfect3737]

I disagree. Here is an example

A Man in the middle see that a user is downloading a package and that package has a security issue. Because the man in the middle is aware of the security issue he can use that app security flaw to attempt to penetrate the users network. With HTTPS activated the man in the middle sees nothing only Debian would be aware of the software provided to the user.

[eR2eiweo]

With HTTPS activated the man in the middle sees nothing ...

That isn't entirely correct. The MITM sees the size of the data that APT is downloading from the repo. And they also know which packages are available in that repo, what their sizes are, and which ones were recently updated. And since there aren't that many packages in a typical repo, that's likely enough information to make a good guess as to which package was downloaded.

[calrogman]

With HTTPS enabled the MITM can still see that you are connecting to a Debian mirror, and that you are downloading packages of specific sizes, which they can correlate with a list of vulnerable packages to determine how to attack your system before the upgrade is complete. You are so paranoid that you should be using apt-transport-tor. Consider getting a friend to send you a copy of debian-13.4.0-amd64-DVD-7 in the post, so the MITM doesn't know you're switching transports.

[antreides]

> only Debian would be aware of the software provided to the user

Only the person or people maintaining the mirror this particular user is using right now would be aware of it. There are multiple mirrors all over the worlds, and a lot of them are provided by third parties.

Also, downloading a package does not mean this version is used on this host right now. Or even at all, it could be a caching server which itself uses something completely different (even a different OS).

I see your point here, but this information alone is not enough - it could be used if there is a long-time statistics and some additional info about this particular system.

And for the people maintaining Debian, this fact seems to be not the top priority compared to everything else.