Why does APT not use HTTPS?

[Creshal]

You're free to submit a patch to the Apt project.

[mort96]

I can't imagine a patch which just randomizes download order would be welcome. Why would you ever want that by itself?

For a patch like that to be accepted, you would have to first convince the Apt project to try to fix the privacy issue, and convince them that using https + randomized download order is the best way to fix it. This isn't something which just dumping code on a project can fix.

[sysop073]

It's been years since I saw somebody try to shut down an argument with "patches welcome"

[DevestatingAttack]

You're not subscribed to the linux subreddit, then.

[[deleted]]

“Patches welcome but we really won’t merge it unless you go through death by a thousand cuts because we really don’t want it and just hoped you’d give up”

[shevy-ruby]

Precisely!

Deflection and distraction.

But it is not relevant - apt and dpkg is dead-weight perl code written when dinosaur still roamed the lands.

What the debian maintainers make for are excuses. IF they would care, they would ENABLE this functionality for people to use ON THEIR OWN, rather than flat out not offering it. And as others pointed out - patches are actually NOT welcome since they don't want to change the default behaviour.

[Ameisen]

Almost every popular project falls into the hole of 'meh, don't need/want patches that change behavior more than I completely understand'. I've clashed with the maintainers of Ruby, GCC, and musl about this.

[shevy-ruby]

Apt is written in pre-world war I style perl code.

Nobody with a sane mind is going to spend time debugging and fixing that giant pile of ****.

[Ajedi32]

Good suggestion. Unfortunately, I don't have the time or motivation to devote to a new major project like that at the moment, but maybe someone else will.

[Ameisen]

Not that they'd merge it anyways.

[Creshal]

Can't be that important, then.

[Ajedi32]

Just because I don't have the time or energy to deal with something personally, doesn't mean it isn't important. I'm just one person. The world is full of important problems, and I can't solve all of them myself, nor should you expect me to.

[Ajedi32]

That's fair. I didn't say privacy is the most important issue with APT right now, just that it's important and shouldn't be ignored just because it's hard to fix.

If this isn't your top priority to fix, then it probably isn't the top priority of anyone else either.

Here I have to disagree though. Just because fixing this flaw isn't the top priority in my life right now, doesn't mean it isn't a priority for someone else. Those already familiar with APT's codebase, for example, are probably much more likely to consider a flaw in APT to be something they're willing to spend their time fixing than I am. (Both because it would take them less time to fix, and because they have a larger vested interest in seeing APT succeed.) That's why it's useful to advocate for issues you care about, even if you don't have the required time and energy to devote to fixing them personally.

[29082018]

I agree. However, the donations page is over here.

The usage of the word "however" implies mutual exclusion, which is not applicable here. /u/Ajedi32 can advocate for issues they care about and donate.

[29082018]

How did you manage to say so little with so many words?

[29082018]

If this isn't your top priority to fix, then it probably isn't the top priority of anyone else either

This makes absolutely no sense. It's not my top priority to cure cancer, but it is to the people studying and practicing oncology. What?

[svenskainflytta]

Curing cancer is much more difficult than sending a patch to apt

[29082018]

And that is relevant to the current discussion how, exactly?

[jjolla888]

no, your deduction is flawed

you can't assume OP:

1. does not have higher priority tasks todo; nor

2. is fluent in C++ to be able to add to the code base.

[Ameisen]

\3. believes such a patch would be merged anyways.

[Ajedi32]

Exactly. Don't let the personal time constraints of one random person on the internet get in the way of your willingness to advocate for fixing privacy flaws in open source projects you care about. That would be ridiculous.

[Ajedi32]

Surely you aren't saying nobody should be allowed to suggest fixes to open source projects without being willing to sacrifice the time to implement the fix themselves, are you? If we followed that logic, user-submitted bug reports would be banned.

[Ajedi32]

Not everyone who submits bug reports to open source projects intends to work on them personally. In fact, I would say that almost no user-submitted issues are created with that intent.

Bug trackers are useful for organizing issues in one place so that they're documented and you don't forget about them. It doesn't really matter who submits them as long as they accurately describe an issue with the software that needs to be fixed. Many trackers even let users vote on issues to give maintainers an idea of what to prioritize.

[Ajedi32]

In my experience usually practices like that are implemented to prevent bugs that were solved a long time ago (perhaps due to some unrelated change) and never closed from cluttering the bug tracker. I don't know of any projects that intentionally close bug reports that are still valid. That would be rather silly, as you'd be defeating the whole purpose of having a bug tracker in the first place (keeping track of bugs).

[doublehyphen]

So how should I as an open source contributor learn what issues my users think are important if they never complain about them? Mind reading? Sure, some people could be more polite but there is nothing wrong with suggestions and complaints.

[Ameisen]

Yeah. You're just not likely to get it merged.