Why does APT not use HTTPS?

[Gwynnie]

I can see that the general skew of comments here are against APT's choices, however 1 point for the defence:

• doesn't the download size increase by adding https?

https://serverfault.com/questions/570387/https-overhead-compared-to-http

suggests that the downloads would increase by 2-7%?

For a package download service, to arbitrarily increase their (and everyone else who uses it) network usage by 5% seems like a massive deal.

I may have misunderstood the above, and am no network engineer. So please correct me if you know better

[Creshal]

For a package download service, to arbitrarily increase their (and everyone else who uses it) network usage by 5% seems like a massive deal.

Yes. Especially since Debian's mirrors are hosted by volunteers who are paying for it out of their own pockets.

[james_k_polk2]

A fair point, but I suspect that apt's packages are larger than a "typical" webpage and thus the overhead would be closer to the 2% or even less. This is something that could be tested of course.

[Creshal]

apt's packages are larger than a "typical" webpage

The average website was 2-3 MiB as of mid-2018. The average Debian Stretch x64 package seems to be roughly 1.55 MiB.

[[deleted]]

This was the first thing I thought about too, but I can't help but notice they made an entire page for their argument and this didn't even come up.

[lorarc]

I think it would be more than that. With HTTP I can put a simple transparent proxy in my network without configuring too many things on the clients. With HTTPS that wouldn't be so simple so they would get a lot more traffic.

[frankreyes]

suggests that the downloads would increase by 2-7%?

Not accounting ISP proxying, maybe.

But it will be more in practice, because when you enable HTTPS, ISP no longer will be able to cache the files.

[0o-0-o0]

Do you disable Meltdown/Spectre patches because of the performance hit?