On Wed, Oct 19, 2022 at 4:01 AM Vitaly Zaitsev via devel
<devel(a)lists.fedoraproject.org> wrote:
On 19/10/2022 09:48, Peter Robinson wrote:
> Sure but as mentioned it's public data, and the modification, and I
> covered that in my reply, would be picked up by the other mechanisms.
They can collect a lot of sensitive information: your IP, Fedora
version, packages version, etc. This can help with recon for attackers.
HTTPS does not help with that. It's just a transport protocol.
> There isn't actually that many mirrors left do we
> really want to reduce the number more for end users for no actual
> improvement in security?
It will improve privacy at least.
Not in any meaningful way, and in most cases HTTPS makes mirrors slower too.
> Ultimately bandwidth is expensive in a lot of
> parts of the world for commercial entities to provide, that's why
> there's mirrors.
Fedora COPR has moved to Amazon CDN. Maybe Fedora's main mirror can
switch to a CDN too?
We don't have a "main mirror" for that to work.
--
真実はいつも一つ!/ Always, there's only one truth!