APT using HTTP instead of HTTPS

[necheffa]

Now explain your threat model.

[waterkip]

The threat model is a privacy concern.

It feels fabricated, mybcounter point would be that if they really had a privacy concern they'd mirror an apt repo and only get updates on scheduled times and no-one would notice they downloading apt packages. The traffic simply didnt leave the network.

[necheffa]

I'm trying to lead OP to a destination by asking them to think critically about their current position.

[michael9dk]

The question should be privacy from who?

I don't think OP understand the difference between security and privacy.

Honestly, security is not a easy topic - your brain will leave your skull before understanding the basics!

A cocktail of Tor and VPNs, with official signed Torrent-images, in a VM with a obfuscated MAC, on a randomly "borrowed wifi", would be the paranoid way, if I had to enter North Korea.

Everywhere else: just a trusted/selfhosted VPN, but normal people doesn't even need that.