alt Hacker NewsIt kind of makes sense opsec wise when you are on a network with adversaries though.
1) Others knowing knowing exactly which package you are downloading could give them a very clear way to fingerprint and target services you are running
2) HTTPS could allow you to potentially reduce your risk surface in a case where there is a bug in Steam's signature checker itself and someone sends a crafted payload instead of game files. Server validation would have prevented that. This has actually happened with apt before: CVE-2019-3462.
Odds are small, but I believe in DiD. I could imagine an attacker with nothing better to do could get up to this on say, a Uni's network.
And before you come at me with I should be using a VPN to protect against these scenarios, I do that already. This is about HTTPS being a sane default when possible.
Replies
> fingerprint and target services
Or they could connect to the service.
> Server validation would have prevented that
No it wouldn't have. HTTPS does not ensure a server's contents are trustworthy.
> And before you come at me with I should be using a VPN to protect against these scenarios, I do that already
So you protect yourself from unlikely, irrelevant threats by... deliberately paying strangers to MiTM your traffic?
But we're talking about an air filter, not a production server.