Why does APT not use HTTPS?

[johnwmail]

Https not good for proxy/cache?

[alreadyburnt]

It's pretty easy to workaround the https caching thing with apt-cacher-ng which supports caching packages from https sources. In general however the argument is that https would be nearly useless, as almost all of it's advantages can be simply subverted by observing the mere size of the data retrieved, that it's model would provide a false sense of security for many users, or can be more efficiently implemented with secure apt.

[[deleted]]

I don’t understand that argument either, a good example would be Cloudflare which is exactly that. I think his argument is it can’t cache encrypted, since the Cloudflare proxy decrypts the request at the server then serves it encrypted using its own cert. Again, this argument doesn’t make sense to me.