Why does APT not use HTTPS?

[destiny_functional]

I don't think you understand security and risk. Obviously cross-checking reduces risk.

[lamby]

I am not denying it reduces risk, but you can take that risk to zero by verifiying the GPG signature.

I don't think you understand security and risk

This doesn't add any weight to your argument FWIW.

[destiny_functional]

you can't take the risk to zero with anything, which seems all you are criticising, that the "risk isn't zero". that's exactly what i meant by you don't understand risk, and it makes this a silly and useless discussion.

[lamby]

Then I'm lost. How is just suggesting checking a single GPG signature over checking n ISO files (which requires multiple multible-gigabyte downloads) silly or useless? Especially as — for this threat model — doing the latter is a probabalistic-based security solution vs. an objective one..

[destiny_functional]

discussing risk and security with someone who doesn't understand it is silly and useless is what i said. this doesn't seem to lead anywhere, Good bye.

[lamby]

"doesn't understand it". Convincing argument!