** Description changed: The main ubuntu site "ubuntu.com" lacks SSL (HTTPS) support in any form, as well as the release domain "releases.ubuntu.com". This poses a risk to those on insecure connections, such as public/shared Wi-Fi, Tor, or where there are ISP's tampering with the connection. The intermediary could modify the page to show tampered Ubuntu images, and modify the hashes/signature links to another intercepted page on the ubuntu website Standard SSL certificates cost as little as $10/year, and with free SSL services such as https://letsencrypt.org/ there's no good reason for a - lack of SSL support on the Ubuntu websites. + lack of SSL support on the Ubuntu websites, and the resource impact is + likely negligible: https://stackoverflow.com/questions/548029/how-much- + overhead-does-ssl-impose + + Many other distributions have SSL on their main websites, including + Fedora (on both the main site, and the release downloads), Arch Linux + (site+ some of their release mirrors), and OpenSUSE (main site only).
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1529280 Title: Ubuntu site and release domain lacks SSL To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+bug/1529280/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
