[GF-Users] Any chance to have https for mirror.ghettoforge.org?

[Peter]

On 16/04/19 8:46 PM, Eugene Glotov wrote:
> I found a useful package located on http://mirror.ghettoforge.org 
> <http://mirror.ghettoforge.org/>. But `http` is confusing me. Is there 
> any plans to add https to the mirror?

No.  The packages are not exactly private data, so there is no reason to 
encrypt the content and the packages themselves are signed so there is 
no reason for the connection to be secure.

Keep in mind that while this mirror is run by GhettoForge, it is not 
uncommon for projects to use multiple mirrors run by different entites 
and as such the only way to actually trust the content on the mirrors is 
if the packages themselves are signed.  It's up the the mirror providers 
themselves if they wish to offer https or not, but doing so does not 
make the packages themselves any more secure.


Peter