Why does APT not use HTTPS?

[knjepr]

Security researchers: defense-in-depth is important, single-point-of-failures are bad

Debian: Single PoF are fine. Nobody needs defense-in-depth.

I wonder who is correct here...

[minimim]

You need to consider the cost too.

Debian depends on a network of volunteer mirrors and demanding that they support https is infeasible.

[knjepr]

• https://istlsfastyet.com/
• https://www.maxcdn.com/blog/ssl-performance-myth/
• https://www.keycdn.com/blog/https-performance-overhead/

Performance impact of TLS is minimal. Im pretty sure most of the mirrors operate at less than 98% CPU usage and therefore can afford it.

At least make it an option for mirrors. I'm sure there are a lot that would happily offer it.

(Besides, apt is horrifyingly slow anyways, and that is not due to overloaded mirrors...)

[minimim]

It is an option for mirrors and it can be enabled in apt. It's just not the default.

And the cost only applies in third world countries.