search

syncthing / apt-web

The web component of http://apt.syncthing.net/
11 stars 18 forks source link

The work of debian repositories on HTTP #27

Open Ratio2 opened 2 years ago

Ratio2 commented 2 years ago

Some HTTPS traffic is blocked in my country (probably due to HTTPS extensions).

It would be nice to make debian repositories work through HTTP, since they are still checked for integrity by the package manager.

$ curl https://download.virtualbox.org/virtualbox/debian
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
...

$ curl https://syncthing.net
<!DOCTYPE html>
...

$ curl https://apt.syncthing.net
curl: (28) Failed to connect to apt.syncthing.net port 443: Connection timed out

$ curl http://apt.syncthing.net
Moved Permanently
calmh commented 2 years ago

Yeah this used to work, but I moved it around a bit and now it's HTTPS only apparently. I'll see if I can fix that.

Ratio2 commented 2 years ago

Same problem for https://relays.syncthing.net/endpoint

dynamic+https://relays.syncthing.net/endpoint: Get "https://relays.syncthing.net/endpoint": dial tcp 143.244.196.6:443: i/o timeout

The list of relays is also not critical and can be accessed via HTTP.

Only https://syncthing.net/ works

calmh commented 2 years ago

Relays have never been available over http though.

Ratio2 commented 2 years ago

I understand that relays have always been available only via HTTPS. But it will not be superfluous to have access to them also via HTTP. This will add flexibility, and there are no shortcomings at first glance.

relays.syncthing.net and apt.syncthing.net are at the same address, possibly on the same server.

This will solve my specific problem with HTTPS blocking, maybe it will help someone else in the future.

calmh commented 2 years ago

To be honest, your specific issue with your government blocking HTTPS left and right isn't something I really care about enough to put effort into fixing, especially when HTTPS is generally speaking much superior to HTTP in all cases. There is, perhaps, a case to be made for apt.syncthing.net specifically to be available over HTTP because it's traditional for Debian archives to use HTTP and, historically, some of the tooling didn't work out of the box with HTTPS.

This is not a reason to HTTP-enable other services that have always been HTTPS and really should stay HTTPS.