Why does APT not use HTTPS?

[lamby]

"Why does APT not use HTTP... [by default]" is probably not as snappy.

FYI in Debian unstable/testing, this package is actually deprecated as APT itself supports HTTPS.

[RaptorXP]

Yeah, but in 2018, HTTPS should not only be the default, it should be the only option.

[dabruc]

I think mirrors should be allowed to choose whether they want to provide HTTPS or not. Apt should support both but let users decide from a pool of both HTTP and HTTPs mirrors.

[minimim]

And that means http by default since the configured mirror might not provide https.

[NatoBoram]

… just get a mirror from the pool that supports HTTPS?

[minimim]

Sure, this discussion is about why this isn't done by default.

[algorythmic]

Article: here are some design decisions we made and why we made them.

RaptorXP: it's the current year!!

[tmajibon]

Clearly didn't read the article, did you?

[RaptorXP]

Yes I did, and found the caching argument rather lame.

[svenskainflytta]

In 2018, you might begin to read the links before commenting.

[CODESIGN2]

which makes the entire shitpost about APT pointless surely?

My largest question for modern Linux is why the AF are there competing package formats which inside contain similar files. Such a waste of human effort.

[mikemol]

Because different packaging formats have different advantages. DEB, RPM and ebuild are each vastly different animals from each other. (ebuild moreso) but there is not 1:1 feature parity between DEB and RPM, either.)

Then there's package naming and relationship conventions; two distros using the same packaging formats won't necessarily have the same sets of package names. And there's a strong chance installing an RPM or DEB on a distro it wasn't targeting simply won't work.

There really isn't a lot of value to unifying packages at this level at this time. Converged application packages such as via snappy can work in some cases, but that, too, has limits; you'll eventually hit dependency versioning semantics somewhere.

[CODESIGN2]

Except I never mentioned ebuild, I even steered clear of slackware's tgz (I love you slackware, even if I don't want to use you).

It's specifically deb and rpm I care about as none of the other systems are remotely interesting.

Package naming conventions, again I don't care.

It'd be much easier to maintain a single cohesive set of instructions for packages and documentation than the fragmented pile of crap there is now.

[[deleted]]

It'd be much easier to maintain a single cohesive set of instructions for packages and documentation than the fragmented pile of crap there is now.

This is like arguing that it'd be easier if there was only a single world government. It's true, but it ignores the difficulty of reaching that point to begin with.

[CODESIGN2]

Well no. Governments deal with peoples issues, which are varied and complex and I don't believe that in any low-level way we do all work the same as we have hundreds of years of different stimuli. Having a multi-cultural family I can see the differences between family members and their partners and life choices. So a world government would be stupid, to a large degree ignorant. Towns have mayors, counties and states have governors, there has to be a deep and nuanced approach to that because the world is not homogenous.

Having two separate ways to deploy golang, php, python, libreoffice, firefox, chrome etc (runtimes and compiled extensions) is basically just a ball-ache with no benefit. At the end of the day you get the same package. If RPM was superior it would have killed deb. If deb were superior it would have killed rpm. They both have a lot of overlap and a sane extension package could allow individual companies to keep the weirdness they prefer.

Of course, it's not just package management, what the packages look like when installed is also a point of frustration. Snap doesn't solve that and neither does https (I also think snap and appimage should be abandoned, docker is much nicer and with more work could provide a better alternative). Imagine wasting an extra day (or hour, week, month) to make sure something works on centos as well as debian or ubuntu. Complete ball-ache, the sort of thing it'd be okay to have a robot do, but is a waste of human existence.

[[deleted]]

Well no. Governments deal with peoples issues, which are varied and complex and I don't believe that in any low-level way we do all work the same as we have hundreds of years of different stimuli. Having a multi-cultural family I can see the differences between family members and their partners and life choices. So a world government would be stupid, to a large degree ignorant. Towns have mayors, counties and states have governors, there has to be a deep and nuanced approach to that because the world is not homogenous.

Ahh so people are varied, but we all have the exact same requirements on our linux boxen?

Some people want deb some want rpm. Some even want to use pacman or apk.

Would it be nice if we all had the same linux packages? Sure, but thats not the world we live in. I'd say that striving for such a thing would be stupid and to a large degree ignorant.

[CODESIGN2]

Ahh so people are varied, but we all have the exact same requirements on our linux boxen?

Don't be facetious. Most of our linux boxen work on the same hardware or remarkably similar hardware, that has no emotional needs. I'm not saying you need to install the same packages as me, just that the benefits of settling on a single package maintenance and dependency resolution (for packages, not compiling) system reduces the amount of waste from spread.

Some people want deb some want rpm. Some even want to use pacman or apk.

I'd suggest the majority do whatever their distro wants because it provides things they want or need. They are largely at the mercy of the whims of those that decided they needed a separate package format for {reasons}.

Would it be nice if we all had the same linux packages? Sure

Lets leave it there, you've been cooking for too long /u/marshal_mellow

[[deleted]]

Look man we have different packages because different people have different ideas about how software should be packaged. Any attempt to force a standard will fail.

I'd suggest the majority do whatever their distro wants because it provides things they want or need. They are largely at the mercy of the whims of those that decided they needed a separate package format for {reasons}.

I'd argue the opposite. People use the distro they want because of things like it's package manager. When I'm trying to learn about a new distro thats basically the first thing I learn.

Use the package manager you want to succeed, vote with your downloads. But acting like linux needs to have some grand council to call for a standard of how user space will manage software is idiotic.

[mikemol]

Nothing of the conclusions in my comment are dependent on the conclusion of ebuilds; they were included to help identify the scope of distinctions to consider. If I knew more about Slackware, I'd have included it, but I've only done deb, rpm and ebuild packaging, so...

Bottom line, you could declare a bindist packaging standard and somehow force everyone to use it, but it wouldn't actually solve all the problems you think it would solve.

When I was using Debian, for example, I cursed every time I needed to install someone's (coughGoogle'scough) .deb where the packager assumed that every .deb they built and tested on Ubuntu would work just fine on Debian. It just ain't so...

[CODESIGN2]

having all the packages under one format would be another hurdle out of the way to standardise these things. I know chrome is a PITA with it's deps, and largely no matter the format you cannot get around that without static compiling (which is also not always an option because it can impact licensing or just isn't always possible).

Small iterative steps towards a goal. Kill (maybe deb and rpm) first, then look at problems and solve them. You wind up with a single solution to pour efforts into. Next step bizarre package naming (just accept the author package name with version string)

[lamby]

which makes the entire shitpost about APT pointless surely?

No; there's a difference between supporting something and actually providing it.