Public bug reported: The main ubuntu site "ubuntu.com" lacks SSL (HTTPS) support in any form, as well as the release domain "releases.ubuntu.com".
This poses a risk to those on insecure connections, such as public/shared Wi-Fi, Tor, or where there are ISP's tampering with the connection. The intermediary could modify the page to show tampered Ubuntu images, and modify the hashes/signature links to another intercepted page on the ubuntu website Standard SSL certificates cost as little as $10/year, and with free SSL services such as https://letsencrypt.org/ there's no good reason for a lack of SSL support on the Ubuntu websites. ** Affects: ubuntu Importance: Undecided Status: New ** Tags: https security ssl website -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1529280 Title: Ubuntu site and release domain lacks SSL To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+bug/1529280/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
