Centos – Why are CentOS mirrors HTTP and not HTTPS

centoshttphttpsSecurity

As far as I know, HTTP is prone to man-in-the-middle attacks. As such, the repositories in Alpine Linux or the CentOS Mirrors are not HTTPS.

In the olden days, having HTTPS used to be an expensive matter. It cost server CPU time and the certificates weren't free. But it’s 2022 now, and we have plenty of ways to overcome those problems and security has been top priority than ever!

How can we obtain binaries smarter?

Also is this a problem in the wider Linux community? I.e., Ubuntu, Linux Mint, openSUSE, etc.?

Best Answer

The packages are indeed signed, hence a manipulation would be noticed.

Also the packages are not secret, so there isn't any need to encrypt them on the transfer.

With the mass of downloads from mirrors, this probably saves them a lot of resources.

It is the same on Debian and Ubuntu.