Ask HN: Why do major operating system installs default to HTTP instead of HTTPS

3 points

2 years ago

I've noticed this lately and never really paid attention before, but fresh installs of Debian use ftp or http for the package repos, and when doing a full reinstall of macOS, the initial recovery image, and then the full install image, are both pulled from a http endpoint.

Wouldn't these things be the most crucial endpoints to secure with SSL? Why are they not done so by default? I know you can tell Debian to use https, and I'm sure apple has certs on those os image servers, but of all things to leave open to easily being MITM'd, it should not be the install image on your device. That makes everything after that completely untrustworthy imo. If I was served a rooted mac recovery image, I'm fucked from the get go, and it is weird that https isn't required. I know root trust on a bare install is probably a pain in the ass, but it's apple, they can and should do something here. Supply chain security starts with the base OS.

2 comments