On 19/10/2022 09:33, Peter Robinson wrote:
Why are they insecure? This is public open data, not banking data,
where the data being downloaded is verifiable by the rpm signatures
and signing keys.
ISPs or anyone on the the same network can view, intercept or even
modify HTTP/rsync traffic.
The flip side is we remove the non https mirrors and the mirror
system
slows down considerably, or in some cases is even unavailable, for
users which in IMO is more of a problem because people then really do
have insecure systems.
We can give mirror owners some time (for example, a month) to migrate
their mirrors to HTTPS.
--
Sincerely,
Vitaly Zaitsev (vitaly(a)easycoding.org)