ubuntu apt - why are the respositories accessed over HTTP?
So I was just updating my Ubuntu 18.04 system as usual, when I noticed that the apt repositories are being accessed via HTTP. A quick internet search confirmed that this is standard (at least with ubuntu), but didn't yield an answer to why. Now I know that apt performs signature / sanity checks of the packages, but still, why isn't HTTPS used?
Edit 2019-01-24: In light of the recent RCE exploit because of the HTTP communication, I want to point out to some current links I found regarding this topic.
https://whydoesaptnotusehttps.com/ -> A single purpose website only for explaning why HTTP is sufficient.
https://justi.cz/security/2019/01/22/apt-rce.html -> How to exploit the HTTP connection to execute arbitrary code on the target host (and also how to protect yourself against such an attack).
https://usn.ubuntu.com/3863-1/ -> Ubuntu security notice
https://lists.debian.org/debian-security-announce/2019/msg00010.html -> Debian security advisory.
linux ubuntu http packages apt
asked Sep 10 '18 at 8:03
M.GeigerM.Geiger
112
add a comment |
So I was just updating my Ubuntu 18.04 system as usual, when I noticed that the apt repositories are being accessed via HTTP. A quick internet search confirmed that this is standard (at least with ubuntu), but didn't yield an answer to why. Now I know that apt performs signature / sanity checks of the packages, but still, why isn't HTTPS used?
Edit 2019-01-24: In light of the recent RCE exploit because of the HTTP communication, I want to point out to some current links I found regarding this topic.
https://whydoesaptnotusehttps.com/ -> A single purpose website only for explaning why HTTP is sufficient.
https://justi.cz/security/2019/01/22/apt-rce.html -> How to exploit the HTTP connection to execute arbitrary code on the target host (and also how to protect yourself against such an attack).
https://usn.ubuntu.com/3863-1/ -> Ubuntu security notice
https://lists.debian.org/debian-security-announce/2019/msg00010.html -> Debian security advisory.
linux ubuntu http packages apt
asked Sep 10 '18 at 8:03
M.GeigerM.Geiger
112
Ask Ubuntu developers at Canonical.
– Ipor Sircer
Sep 10 '18 at 8:06
Well...thank you. I tagged this question with 'apt' and 'ubuntu', why wouldn't it be okay to ask here?
– M.Geiger
Sep 10 '18 at 8:12
I think this would be more appropriate on askubuntu.com
– phuclv
Sep 10 '18 at 9:09
Yes, you might be correct. However, since not only Ubuntu uses apt, it might be wrong there as well. I just checked the default Debian sources.list which also uses simple HTTP. Edit: However then my tags and question title might be misleading.
– M.Geiger
Sep 10 '18 at 9:12
add a comment |
So I was just updating my Ubuntu 18.04 system as usual, when I noticed that the apt repositories are being accessed via HTTP. A quick internet search confirmed that this is standard (at least with ubuntu), but didn't yield an answer to why. Now I know that apt performs signature / sanity checks of the packages, but still, why isn't HTTPS used?
Edit 2019-01-24: In light of the recent RCE exploit because of the HTTP communication, I want to point out to some current links I found regarding this topic.
https://whydoesaptnotusehttps.com/ -> A single purpose website only for explaning why HTTP is sufficient.
https://justi.cz/security/2019/01/22/apt-rce.html -> How to exploit the HTTP connection to execute arbitrary code on the target host (and also how to protect yourself against such an attack).
https://usn.ubuntu.com/3863-1/ -> Ubuntu security notice
https://lists.debian.org/debian-security-announce/2019/msg00010.html -> Debian security advisory.
linux ubuntu http packages apt
asked Sep 10 '18 at 8:03
M.GeigerM.Geiger
112
So I was just updating my Ubuntu 18.04 system as usual, when I noticed that the apt repositories are being accessed via HTTP. A quick internet search confirmed that this is standard (at least with ubuntu), but didn't yield an answer to why. Now I know that apt performs signature / sanity checks of the packages, but still, why isn't HTTPS used?
Edit 2019-01-24: In light of the recent RCE exploit because of the HTTP communication, I want to point out to some current links I found regarding this topic.
https://whydoesaptnotusehttps.com/ -> A single purpose website only for explaning why HTTP is sufficient.
https://justi.cz/security/2019/01/22/apt-rce.html -> How to exploit the HTTP connection to execute arbitrary code on the target host (and also how to protect yourself against such an attack).
https://usn.ubuntu.com/3863-1/ -> Ubuntu security notice
https://lists.debian.org/debian-security-announce/2019/msg00010.html -> Debian security advisory.
linux ubuntu http packages apt
linux ubuntu http packages apt
asked Sep 10 '18 at 8:03
M.GeigerM.Geiger
112
asked Sep 10 '18 at 8:03
M.GeigerM.Geiger
112
edited Jan 24 at 15:48
M.Geiger
asked Sep 10 '18 at 8:03
M.GeigerM.Geiger
112
asked Sep 10 '18 at 8:03
M.GeigerM.Geiger
112
asked Sep 10 '18 at 8:03
M.GeigerM.Geiger
112
112
Ask Ubuntu developers at Canonical.
– Ipor Sircer
Sep 10 '18 at 8:06
Well...thank you. I tagged this question with 'apt' and 'ubuntu', why wouldn't it be okay to ask here?
– M.Geiger
Sep 10 '18 at 8:12
I think this would be more appropriate on askubuntu.com
– phuclv
Sep 10 '18 at 9:09
Yes, you might be correct. However, since not only Ubuntu uses apt, it might be wrong there as well. I just checked the default Debian sources.list which also uses simple HTTP. Edit: However then my tags and question title might be misleading.
– M.Geiger
Sep 10 '18 at 9:12
add a comment |
Ask Ubuntu developers at Canonical.
– Ipor Sircer
Sep 10 '18 at 8:06
Well...thank you. I tagged this question with 'apt' and 'ubuntu', why wouldn't it be okay to ask here?
– M.Geiger
Sep 10 '18 at 8:12
I think this would be more appropriate on askubuntu.com
– phuclv
Sep 10 '18 at 9:09
Yes, you might be correct. However, since not only Ubuntu uses apt, it might be wrong there as well. I just checked the default Debian sources.list which also uses simple HTTP. Edit: However then my tags and question title might be misleading.
– M.Geiger
Sep 10 '18 at 9:12
Ask Ubuntu developers at Canonical.
– Ipor Sircer
Sep 10 '18 at 8:06
Ask Ubuntu developers at Canonical.
– Ipor Sircer
Sep 10 '18 at 8:06
Well...thank you. I tagged this question with 'apt' and 'ubuntu', why wouldn't it be okay to ask here?
– M.Geiger
Sep 10 '18 at 8:12
Well...thank you. I tagged this question with 'apt' and 'ubuntu', why wouldn't it be okay to ask here?
– M.Geiger
Sep 10 '18 at 8:12
I think this would be more appropriate on askubuntu.com
– phuclv
Sep 10 '18 at 9:09
I think this would be more appropriate on askubuntu.com
– phuclv
Sep 10 '18 at 9:09
Yes, you might be correct. However, since not only Ubuntu uses apt, it might be wrong there as well. I just checked the default Debian sources.list which also uses simple HTTP. Edit: However then my tags and question title might be misleading.
– M.Geiger
Sep 10 '18 at 9:12
Yes, you might be correct. However, since not only Ubuntu uses apt, it might be wrong there as well. I just checked the default Debian sources.list which also uses simple HTTP. Edit: However then my tags and question title might be misleading.
– M.Geiger
Sep 10 '18 at 9:12
add a comment |
2 Answers
2
active
oldest
votes
Most of the time the files are downloaded from a mirror and not from the ubuntu servers, so even if the ubuntu site uses HTTPS, you are going to be downloading files from sites like http://ubuntu.unc.edu.ar/ubuntu/or http://ubuntu.mirror.lrz.de/ubuntu/.
To overcome this problem, the files downloaded by APT have a signature that allows that it can be verified against the public keys stored on your computer as being signed by Ubuntu and only Ubuntu.
answered Sep 10 '18 at 8:21
jcbermujcbermu
15.6k24354
1
Thank you for your answer! I understand that public key signatures protect the integrity and authenticity of data. However wouldn't it be desirable to encrypt the data as well so that an adversary might not know what software and what versions thereof are used? I can imagine a - yes maybe complex - attack where an attacker uses the information which software version is used in an attack.
– M.Geiger
Sep 10 '18 at 8:45
@M.Geiger That is indeed a concern of some users, including myself. IMO there is no good reason to use plain HTTP for package repositories these days, and at least one very good reason to use HTTPS, as you pointed out.
– l0b0
Sep 10 '18 at 9:48
@l0b0 Ok, so I'm not the only one. I also found the package apt-transport-https, which looks like it should do the job. I already had this installed. Unfortunately, when I switch every http to https in my Ubuntu sources.list, updating fails withCould not connect to de.archive.ubuntu.com:443 (141.30.62.25). - connect (111: Connection refused).
– M.Geiger
Sep 10 '18 at 9:59
add a comment |
In my opinion it is because is a layer not necessary for the purpose!
I mean https is needed to encrypt the data over the network to avoid to send sensitive data in clear text (never authenticate your self in http protocol).
So have no traffic to protect there, mostly of the code is opensource and can be downloaded and redistribuite. What is need to be protected is the binary package by him self, but for this all the package in the repository are digital signed, and if the public key is not installed on your package manager will notify you that the software you begin to install is came from a not trusted place.
answered Sep 10 '18 at 8:20
AtomiX84AtomiX84
4779
Thank you for your answer, I appreciate the hint that most of linux software is open source, so this might be a good reason, why it doesn't have to be encrypted for confidentiality.
– M.Geiger
Sep 10 '18 at 8:48
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1356786%2fubuntu-apt-why-are-the-respositories-accessed-over-http%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
Most of the time the files are downloaded from a mirror and not from the ubuntu servers, so even if the ubuntu site uses HTTPS, you are going to be downloading files from sites like http://ubuntu.unc.edu.ar/ubuntu/or http://ubuntu.mirror.lrz.de/ubuntu/.
To overcome this problem, the files downloaded by APT have a signature that allows that it can be verified against the public keys stored on your computer as being signed by Ubuntu and only Ubuntu.
answered Sep 10 '18 at 8:21
jcbermujcbermu
15.6k24354
1
Thank you for your answer! I understand that public key signatures protect the integrity and authenticity of data. However wouldn't it be desirable to encrypt the data as well so that an adversary might not know what software and what versions thereof are used? I can imagine a - yes maybe complex - attack where an attacker uses the information which software version is used in an attack.
– M.Geiger
Sep 10 '18 at 8:45
@M.Geiger That is indeed a concern of some users, including myself. IMO there is no good reason to use plain HTTP for package repositories these days, and at least one very good reason to use HTTPS, as you pointed out.
– l0b0
Sep 10 '18 at 9:48
@l0b0 Ok, so I'm not the only one. I also found the package apt-transport-https, which looks like it should do the job. I already had this installed. Unfortunately, when I switch every http to https in my Ubuntu sources.list, updating fails withCould not connect to de.archive.ubuntu.com:443 (141.30.62.25). - connect (111: Connection refused).
– M.Geiger
Sep 10 '18 at 9:59
add a comment |
Most of the time the files are downloaded from a mirror and not from the ubuntu servers, so even if the ubuntu site uses HTTPS, you are going to be downloading files from sites like http://ubuntu.unc.edu.ar/ubuntu/or http://ubuntu.mirror.lrz.de/ubuntu/.
To overcome this problem, the files downloaded by APT have a signature that allows that it can be verified against the public keys stored on your computer as being signed by Ubuntu and only Ubuntu.
answered Sep 10 '18 at 8:21
jcbermujcbermu
15.6k24354
1
Thank you for your answer! I understand that public key signatures protect the integrity and authenticity of data. However wouldn't it be desirable to encrypt the data as well so that an adversary might not know what software and what versions thereof are used? I can imagine a - yes maybe complex - attack where an attacker uses the information which software version is used in an attack.
– M.Geiger
Sep 10 '18 at 8:45
@M.Geiger That is indeed a concern of some users, including myself. IMO there is no good reason to use plain HTTP for package repositories these days, and at least one very good reason to use HTTPS, as you pointed out.
– l0b0
Sep 10 '18 at 9:48
@l0b0 Ok, so I'm not the only one. I also found the package apt-transport-https, which looks like it should do the job. I already had this installed. Unfortunately, when I switch every http to https in my Ubuntu sources.list, updating fails withCould not connect to de.archive.ubuntu.com:443 (141.30.62.25). - connect (111: Connection refused).
– M.Geiger
Sep 10 '18 at 9:59
add a comment |
Most of the time the files are downloaded from a mirror and not from the ubuntu servers, so even if the ubuntu site uses HTTPS, you are going to be downloading files from sites like http://ubuntu.unc.edu.ar/ubuntu/or http://ubuntu.mirror.lrz.de/ubuntu/.
To overcome this problem, the files downloaded by APT have a signature that allows that it can be verified against the public keys stored on your computer as being signed by Ubuntu and only Ubuntu.
answered Sep 10 '18 at 8:21
jcbermujcbermu
15.6k24354
Most of the time the files are downloaded from a mirror and not from the ubuntu servers, so even if the ubuntu site uses HTTPS, you are going to be downloading files from sites like http://ubuntu.unc.edu.ar/ubuntu/or http://ubuntu.mirror.lrz.de/ubuntu/.
To overcome this problem, the files downloaded by APT have a signature that allows that it can be verified against the public keys stored on your computer as being signed by Ubuntu and only Ubuntu.
answered Sep 10 '18 at 8:21
jcbermujcbermu
15.6k24354
answered Sep 10 '18 at 8:21
jcbermujcbermu
15.6k24354
answered Sep 10 '18 at 8:21
jcbermujcbermu
15.6k24354
answered Sep 10 '18 at 8:21
jcbermujcbermu
15.6k24354
15.6k24354
1
Thank you for your answer! I understand that public key signatures protect the integrity and authenticity of data. However wouldn't it be desirable to encrypt the data as well so that an adversary might not know what software and what versions thereof are used? I can imagine a - yes maybe complex - attack where an attacker uses the information which software version is used in an attack.
– M.Geiger
Sep 10 '18 at 8:45
@M.Geiger That is indeed a concern of some users, including myself. IMO there is no good reason to use plain HTTP for package repositories these days, and at least one very good reason to use HTTPS, as you pointed out.
– l0b0
Sep 10 '18 at 9:48
@l0b0 Ok, so I'm not the only one. I also found the package apt-transport-https, which looks like it should do the job. I already had this installed. Unfortunately, when I switch every http to https in my Ubuntu sources.list, updating fails withCould not connect to de.archive.ubuntu.com:443 (141.30.62.25). - connect (111: Connection refused).
– M.Geiger
Sep 10 '18 at 9:59
add a comment |
1
Thank you for your answer! I understand that public key signatures protect the integrity and authenticity of data. However wouldn't it be desirable to encrypt the data as well so that an adversary might not know what software and what versions thereof are used? I can imagine a - yes maybe complex - attack where an attacker uses the information which software version is used in an attack.
– M.Geiger
Sep 10 '18 at 8:45
@M.Geiger That is indeed a concern of some users, including myself. IMO there is no good reason to use plain HTTP for package repositories these days, and at least one very good reason to use HTTPS, as you pointed out.
– l0b0
Sep 10 '18 at 9:48
@l0b0 Ok, so I'm not the only one. I also found the package apt-transport-https, which looks like it should do the job. I already had this installed. Unfortunately, when I switch every http to https in my Ubuntu sources.list, updating fails withCould not connect to de.archive.ubuntu.com:443 (141.30.62.25). - connect (111: Connection refused).
– M.Geiger
Sep 10 '18 at 9:59
1
1
Thank you for your answer! I understand that public key signatures protect the integrity and authenticity of data. However wouldn't it be desirable to encrypt the data as well so that an adversary might not know what software and what versions thereof are used? I can imagine a - yes maybe complex - attack where an attacker uses the information which software version is used in an attack.
– M.Geiger
Sep 10 '18 at 8:45
Thank you for your answer! I understand that public key signatures protect the integrity and authenticity of data. However wouldn't it be desirable to encrypt the data as well so that an adversary might not know what software and what versions thereof are used? I can imagine a - yes maybe complex - attack where an attacker uses the information which software version is used in an attack.
– M.Geiger
Sep 10 '18 at 8:45
@M.Geiger That is indeed a concern of some users, including myself. IMO there is no good reason to use plain HTTP for package repositories these days, and at least one very good reason to use HTTPS, as you pointed out.
– l0b0
Sep 10 '18 at 9:48
@M.Geiger That is indeed a concern of some users, including myself. IMO there is no good reason to use plain HTTP for package repositories these days, and at least one very good reason to use HTTPS, as you pointed out.
– l0b0
Sep 10 '18 at 9:48
@l0b0 Ok, so I'm not the only one. I also found the package apt-transport-https, which looks like it should do the job. I already had this installed. Unfortunately, when I switch every http to https in my Ubuntu sources.list, updating fails with
Could not connect to de.archive.ubuntu.com:443 (141.30.62.25). - connect (111: Connection refused).– M.Geiger
Sep 10 '18 at 9:59
@l0b0 Ok, so I'm not the only one. I also found the package apt-transport-https, which looks like it should do the job. I already had this installed. Unfortunately, when I switch every http to https in my Ubuntu sources.list, updating fails with
Could not connect to de.archive.ubuntu.com:443 (141.30.62.25). - connect (111: Connection refused).– M.Geiger
Sep 10 '18 at 9:59
add a comment |
In my opinion it is because is a layer not necessary for the purpose!
I mean https is needed to encrypt the data over the network to avoid to send sensitive data in clear text (never authenticate your self in http protocol).
So have no traffic to protect there, mostly of the code is opensource and can be downloaded and redistribuite. What is need to be protected is the binary package by him self, but for this all the package in the repository are digital signed, and if the public key is not installed on your package manager will notify you that the software you begin to install is came from a not trusted place.
answered Sep 10 '18 at 8:20
AtomiX84AtomiX84
4779
Thank you for your answer, I appreciate the hint that most of linux software is open source, so this might be a good reason, why it doesn't have to be encrypted for confidentiality.
– M.Geiger
Sep 10 '18 at 8:48
add a comment |
In my opinion it is because is a layer not necessary for the purpose!
I mean https is needed to encrypt the data over the network to avoid to send sensitive data in clear text (never authenticate your self in http protocol).
So have no traffic to protect there, mostly of the code is opensource and can be downloaded and redistribuite. What is need to be protected is the binary package by him self, but for this all the package in the repository are digital signed, and if the public key is not installed on your package manager will notify you that the software you begin to install is came from a not trusted place.
answered Sep 10 '18 at 8:20
AtomiX84AtomiX84
4779
Thank you for your answer, I appreciate the hint that most of linux software is open source, so this might be a good reason, why it doesn't have to be encrypted for confidentiality.
– M.Geiger
Sep 10 '18 at 8:48
add a comment |
In my opinion it is because is a layer not necessary for the purpose!
I mean https is needed to encrypt the data over the network to avoid to send sensitive data in clear text (never authenticate your self in http protocol).
So have no traffic to protect there, mostly of the code is opensource and can be downloaded and redistribuite. What is need to be protected is the binary package by him self, but for this all the package in the repository are digital signed, and if the public key is not installed on your package manager will notify you that the software you begin to install is came from a not trusted place.
answered Sep 10 '18 at 8:20
AtomiX84AtomiX84
4779
In my opinion it is because is a layer not necessary for the purpose!
I mean https is needed to encrypt the data over the network to avoid to send sensitive data in clear text (never authenticate your self in http protocol).
So have no traffic to protect there, mostly of the code is opensource and can be downloaded and redistribuite. What is need to be protected is the binary package by him self, but for this all the package in the repository are digital signed, and if the public key is not installed on your package manager will notify you that the software you begin to install is came from a not trusted place.
answered Sep 10 '18 at 8:20
AtomiX84AtomiX84
4779
answered Sep 10 '18 at 8:20
AtomiX84AtomiX84
4779
answered Sep 10 '18 at 8:20
AtomiX84AtomiX84
4779
answered Sep 10 '18 at 8:20
AtomiX84AtomiX84
4779
4779
Thank you for your answer, I appreciate the hint that most of linux software is open source, so this might be a good reason, why it doesn't have to be encrypted for confidentiality.
– M.Geiger
Sep 10 '18 at 8:48
add a comment |
Thank you for your answer, I appreciate the hint that most of linux software is open source, so this might be a good reason, why it doesn't have to be encrypted for confidentiality.
– M.Geiger
Sep 10 '18 at 8:48
Thank you for your answer, I appreciate the hint that most of linux software is open source, so this might be a good reason, why it doesn't have to be encrypted for confidentiality.
– M.Geiger
Sep 10 '18 at 8:48
Thank you for your answer, I appreciate the hint that most of linux software is open source, so this might be a good reason, why it doesn't have to be encrypted for confidentiality.
– M.Geiger
Sep 10 '18 at 8:48
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1356786%2fubuntu-apt-why-are-the-respositories-accessed-over-http%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Ask Ubuntu developers at Canonical.
– Ipor Sircer
Sep 10 '18 at 8:06
Well...thank you. I tagged this question with 'apt' and 'ubuntu', why wouldn't it be okay to ask here?
– M.Geiger
Sep 10 '18 at 8:12
I think this would be more appropriate on askubuntu.com
– phuclv
Sep 10 '18 at 9:09
Yes, you might be correct. However, since not only Ubuntu uses apt, it might be wrong there as well. I just checked the default Debian sources.list which also uses simple HTTP. Edit: However then my tags and question title might be misleading.
– M.Geiger
Sep 10 '18 at 9:12