Monday, April 29, 2024
 Popular · Latest · Hot · Upcoming
2
rated 0 times [  2] [ 0]  / answers: 1 / hits: 602  / 2 Years ago, fri, november 26, 2021, 12:26:17

I have the latest Ubuntu installed on Raspberry. During an apt update I was very surprised that the communication is not encrypted.


Why is http://ports.ubuntu.com/ubuntu-ports used and not https://ports.ubuntu.com/ubuntu-ports? Is this still up to date?


# cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=21.10
DISTRIB_CODENAME=impish
DISTRIB_DESCRIPTION="Ubuntu 21.10"

# uname -a
Linux b96eebccc368 5.13.0-1022-raspi #24-Ubuntu SMP PREEMPT Wed Mar 16 07:19:33 UTC 2022 aarch64 aarch64 aarch64 GNU/Linux

# apt update && apt --with-new-pkgs upgrade -y
Hit:1 http://ports.ubuntu.com/ubuntu-ports impish InRelease
Get:2 http://ports.ubuntu.com/ubuntu-ports impish-updates InRelease [115 kB]
Get:3 http://ports.ubuntu.com/ubuntu-ports impish-backports InRelease [101 kB]
Hit:4 https://repo.jellyfin.org/ubuntu impish InRelease
Get:5 http://ports.ubuntu.com/ubuntu-ports impish-security InRelease [110 kB]
Get:6 http://ports.ubuntu.com/ubuntu-ports impish-updates/main arm64 Packages [308 kB]
Get:7 http://ports.ubuntu.com/ubuntu-ports impish-updates/main Translation-en [85.1 kB]
Get:8 http://ports.ubuntu.com/ubuntu-ports impish-updates/main arm64 c-n-f Metadata [5544 B]
Get:9 http://ports.ubuntu.com/ubuntu-ports impish-updates/universe arm64 Packages [166 kB]
Get:10 http://ports.ubuntu.com/ubuntu-ports impish-updates/universe arm64 c-n-f Metadata [4976 B]
Get:11 http://ports.ubuntu.com/ubuntu-ports impish-security/main arm64 Packages [249 kB]
Get:12 http://ports.ubuntu.com/ubuntu-ports impish-security/main Translation-en [67.5 kB]
Get:13 http://ports.ubuntu.com/ubuntu-ports impish-security/main arm64 c-n-f Metadata [4012 B]
Get:14 http://ports.ubuntu.com/ubuntu-ports impish-security/universe arm64 Packages [130 kB]
Get:15 http://ports.ubuntu.com/ubuntu-ports impish-security/universe arm64 c-n-f Metadata [4168 B]
Fetched 1350 kB in 4s (358 kB/s)

More From » apt

 Answers
0

Yes, the default repositories still use HTTP instead of HTTPS - this is true for all platforms.


Basically, this has historical reasons, based on the fact that packages are signed and timestamped, and that adding encryption to the download wouldn't add much security in this case.


However, this Q&A raises some points that it could indeed be a good idea to move to HTTPS in the future.


[#715] Friday, November 26, 2021, 2 Years  [reply] [flag answer]
Only authorized users can answer the question. Please sign in first, or register a free account.
itteast

Total Points: 291
Total Questions: 123
Total Answers: 104

Location: Tuvalu
Member since Wed, Mar 29, 2023
1 Year ago
;