3 replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
source | link

Arguably, when users download an application over the web, the application download should be over HTTPS, because it is the cleanest user experience for users that provides security that they can comprehend. It is arguably realistic to expect many users to check for a green glow in the address bar before they download, but it is not reasonable to (for instance) expect them to compute hashes and check them securely.

However, these application downloads often aren't offered over HTTPS, for a variety of possible reasons:

  • Good reasons: HTTPS prevents caching in the network. This may increase network traffic, load on the server, and load on the client-side network.

  • Bad reasons: People have a mistaken belief that "HTTPS is slow" (which is a myth), because it takes extra work to set up a server with SSL, because they rely upon mirrors and the mirror sites don't use HTTPS, or because people haven't thought of it or don't think they are at risk. For widely-used software, these beliefs are probably short-sighted. Apparently, also some sites may use load-balancers or accelerators that are brain-dead and don't understand HTTPS properly, and they don't want to or can't afford to engineer a proper deployment that can speak HTTPS properly.

Some application distribution sites do use HTTPS. But many do not.

Firefox is one high-profile example of an application that does not use HTTPS by default when you download the application (see How safe are copies of Firefox that are on various Mozilla mirror sites?How safe are copies of Firefox that are on various Mozilla mirror sites?).

Windows Update is all done over a secure channel (akin to HTTPS). Linux package managers use cryptography to protect the software they download, though not HTTPS itself.

Arguably, when users download an application over the web, the application download should be over HTTPS, because it is the cleanest user experience for users that provides security that they can comprehend. It is arguably realistic to expect many users to check for a green glow in the address bar before they download, but it is not reasonable to (for instance) expect them to compute hashes and check them securely.

However, these application downloads often aren't offered over HTTPS, for a variety of possible reasons:

  • Good reasons: HTTPS prevents caching in the network. This may increase network traffic, load on the server, and load on the client-side network.

  • Bad reasons: People have a mistaken belief that "HTTPS is slow" (which is a myth), because it takes extra work to set up a server with SSL, because they rely upon mirrors and the mirror sites don't use HTTPS, or because people haven't thought of it or don't think they are at risk. For widely-used software, these beliefs are probably short-sighted. Apparently, also some sites may use load-balancers or accelerators that are brain-dead and don't understand HTTPS properly, and they don't want to or can't afford to engineer a proper deployment that can speak HTTPS properly.

Some application distribution sites do use HTTPS. But many do not.

Firefox is one high-profile example of an application that does not use HTTPS by default when you download the application (see How safe are copies of Firefox that are on various Mozilla mirror sites?).

Windows Update is all done over a secure channel (akin to HTTPS). Linux package managers use cryptography to protect the software they download, though not HTTPS itself.

Arguably, when users download an application over the web, the application download should be over HTTPS, because it is the cleanest user experience for users that provides security that they can comprehend. It is arguably realistic to expect many users to check for a green glow in the address bar before they download, but it is not reasonable to (for instance) expect them to compute hashes and check them securely.

However, these application downloads often aren't offered over HTTPS, for a variety of possible reasons:

  • Good reasons: HTTPS prevents caching in the network. This may increase network traffic, load on the server, and load on the client-side network.

  • Bad reasons: People have a mistaken belief that "HTTPS is slow" (which is a myth), because it takes extra work to set up a server with SSL, because they rely upon mirrors and the mirror sites don't use HTTPS, or because people haven't thought of it or don't think they are at risk. For widely-used software, these beliefs are probably short-sighted. Apparently, also some sites may use load-balancers or accelerators that are brain-dead and don't understand HTTPS properly, and they don't want to or can't afford to engineer a proper deployment that can speak HTTPS properly.

Some application distribution sites do use HTTPS. But many do not.

Firefox is one high-profile example of an application that does not use HTTPS by default when you download the application (see How safe are copies of Firefox that are on various Mozilla mirror sites?).

Windows Update is all done over a secure channel (akin to HTTPS). Linux package managers use cryptography to protect the software they download, though not HTTPS itself.

2 address comments; added 227 characters in body
source | link

YesArguably, when users download an application downloadsover the web, the application download should be over HTTPS. However, they often aren't, because people have a mistaken belief that "HTTPSit is slow" (whichthe cleanest user experience for users that provides security that they can comprehend. It is a myth), because it takes extra workarguably realistic to set upexpect many users to check for a server with SSL, because they rely upon mirrors andgreen glow in the mirror sites don't use HTTPSaddress bar before they download, or because people haven't thought ofbut it or don't think they are at riskis not reasonable to (for instance) expect them to compute hashes and check them securely. For widely-used software

However, these beliefs are probably short-sighted.application downloads often aren't offered over HTTPS, for a variety of possible reasons:

  • Good reasons: HTTPS prevents caching in the network. This may increase network traffic, load on the server, and load on the client-side network.

  • Bad reasons: People have a mistaken belief that "HTTPS is slow" (which is a myth), because it takes extra work to set up a server with SSL, because they rely upon mirrors and the mirror sites don't use HTTPS, or because people haven't thought of it or don't think they are at risk. For widely-used software, these beliefs are probably short-sighted. Apparently, also some sites may use load-balancers or accelerators that are brain-dead and don't understand HTTPS properly, and they don't want to or can't afford to engineer a proper deployment that can speak HTTPS properly.

On the other hand, someSome application distribution sites do use HTTPS. Windows Update is all done over a secure channel (akin to HTTPS). Linux package managers use cryptography to protect the software they download But many do not.

Firefox is one high-profile example of an application that does not use HTTPS by default when you download the application (see How safe are copies of Firefox that are on various Mozilla mirror sites?).

Windows Update is all done over a secure channel (akin to HTTPS). Linux package managers use cryptography to protect the software they download, though not HTTPS itself.

Yes, application downloads should be over HTTPS. However, they often aren't, because people have a mistaken belief that "HTTPS is slow" (which is a myth), because it takes extra work to set up a server with SSL, because they rely upon mirrors and the mirror sites don't use HTTPS, or because people haven't thought of it or don't think they are at risk. For widely-used software, these beliefs are probably short-sighted.

On the other hand, some application distribution sites do use HTTPS. Windows Update is all done over a secure channel (akin to HTTPS). Linux package managers use cryptography to protect the software they download.

Firefox is one high-profile example of an application that does not use HTTPS by default when you download the application (see How safe are copies of Firefox that are on various Mozilla mirror sites?).

Arguably, when users download an application over the web, the application download should be over HTTPS, because it is the cleanest user experience for users that provides security that they can comprehend. It is arguably realistic to expect many users to check for a green glow in the address bar before they download, but it is not reasonable to (for instance) expect them to compute hashes and check them securely.

However, these application downloads often aren't offered over HTTPS, for a variety of possible reasons:

  • Good reasons: HTTPS prevents caching in the network. This may increase network traffic, load on the server, and load on the client-side network.

  • Bad reasons: People have a mistaken belief that "HTTPS is slow" (which is a myth), because it takes extra work to set up a server with SSL, because they rely upon mirrors and the mirror sites don't use HTTPS, or because people haven't thought of it or don't think they are at risk. For widely-used software, these beliefs are probably short-sighted. Apparently, also some sites may use load-balancers or accelerators that are brain-dead and don't understand HTTPS properly, and they don't want to or can't afford to engineer a proper deployment that can speak HTTPS properly.

Some application distribution sites do use HTTPS. But many do not.

Firefox is one high-profile example of an application that does not use HTTPS by default when you download the application (see How safe are copies of Firefox that are on various Mozilla mirror sites?).

Windows Update is all done over a secure channel (akin to HTTPS). Linux package managers use cryptography to protect the software they download, though not HTTPS itself.

1
source | link

Yes, application downloads should be over HTTPS. However, they often aren't, because people have a mistaken belief that "HTTPS is slow" (which is a myth), because it takes extra work to set up a server with SSL, because they rely upon mirrors and the mirror sites don't use HTTPS, or because people haven't thought of it or don't think they are at risk. For widely-used software, these beliefs are probably short-sighted.

On the other hand, some application distribution sites do use HTTPS. Windows Update is all done over a secure channel (akin to HTTPS). Linux package managers use cryptography to protect the software they download.

Firefox is one high-profile example of an application that does not use HTTPS by default when you download the application (see How safe are copies of Firefox that are on various Mozilla mirror sites?).