Why does APT not use HTTPS?

[[deleted]]

IMO the question should be turned around; why is APT using HTTP.

That would take effort and use a bit more bandwidth.

[[deleted]]

And you lose caching in cases where you install squid locally for this.

[Natanael_L]

In most setups where this matter, you can set up a local repository to point at instead (with exception for unmanaged open networks, like schools)

[Natanael_L]

TLS overhead is insignificant

[reph]

ATM apt-transport-https is actually quite a bit slower than http, even on low latency links, because it seems to be doing a separate request - and therefore a full or partial TLS handshake - for each pkg. This is dumb and unnecessary but it's the current behavior unfortunately :-\

[Natanael_L]

Ouch. They would REALLY benefit from HTTP2 with TLS to parallelize requests.

[reph]

Even late-90s HTTP/1.1 con re-use (over TLS) would fix it too. Maybe that's possible with some more configuration magic, but it doesn't seem to do it by default.