Well, at least it's Debian, so even if they used HTTPS they'd still be vulnerable!

I didn't know that about apt, interesting choice!