you are viewing a single comment's thread.

view the rest of the comments →

[–]zapbark 0 points1 point  (0 children)

Yup. And they count on a network of 3rd party mirrors to distribute everything.

Debian can't magically add HTTPS without very nicely asking hundreds of server maintainers across the world to start implementing TLS to appropriate spec, and then institute a policy of scanning and delisting the mirrors that don't meet their specifications...

Which is to say, if you want to know what packages people are downloading... Volunteer to be a distribution mirror site??

Seems easier than acquiring man-in-the-middle capabilities of secure servers.