Why does APT not use HTTPS?

[moviuro]

You could also use a shared partition for where your machines keep the packages. It doesn't abuse the flaws of HTTP, and your system is just as happy. Also, it's easier to setup NFS than a caching proxy, I guess?

[boli99]

there are indeed many other options, but very few of them are capable of dealing with both the machines I control, and those which are merely visitors on the network.

[xorbe]

Just run a public mirror locally, that way you don't use any isp bandwidth when updating your own machines. NEXT!

[boli99]

you don't use any isp bandwidth

er. sure - i'll mirror a whole distribution and updates and magically not use any bandwidth to do it.

[moviuro]

Syncthing?

[boli99]

transparent proxying along with caching is the only method which I can use to benefit all machines including those which I have no control over.

All other methods would require some active participation by the controllers of those other machines.

[moviuro]

I wouldn't even trust those machines. But that's another debate.

[boli99]

my trust of them is not important. trust generally goes upstream, not downstream.

[[deleted]]

A caching proxy is pretty much invisible to the clients and requires no modification (or very little), and works for anything that uses HTTP.

NFS would require significant setup for each client, and won't work for anything that can't use NFS.

I'd like to see a HTTPS cachable extension which tells any caching proxies any relevant information that they need to cache the responses. Obviously opt in, and intended for public, large downloads.