It kind of makes sense opsec wise when you are on a network with adversaries though.

1) Others knowing knowing exactly which package you are downloading could give them a very clear way to fingerprint and target services you are running

2) HTTPS could allow you to potentially reduce your risk surface in a case where there is a bug in Steam's signature checker itself and someone sends a crafted payload instead of game files. Server validation would have prevented that. This has actually happened with apt before: CVE-2019-3462.

Odds are small, but I believe in DiD. I could imagine an attacker with nothing better to do could get up to this on say, a Uni's network.

And before you come at me with I should be using a VPN to protect against these scenarios, I do that already. This is about HTTPS being a sane default when possible.

▲

teaearlgraycold a day ago | parent | next [-]

But we're talking about an air filter, not a production server.

	▲	notaproton a day ago \| parent [-]
		I'm all for Air Filters using HTTP! The default for package upgrades on PCs should be HTTPS (as it already is on Arch, Alpine, NixOS, Flatpak, and Homebrew) since it reduces risk with minimal performance impact for most users.

▲

sippingabonedry a day ago | parent | prev [-]

> fingerprint and target services

Or they could connect to the service.

> Server validation would have prevented that

No it wouldn't have. HTTPS does not ensure a server's contents are trustworthy.

> And before you come at me with I should be using a VPN to protect against these scenarios, I do that already

So you protect yourself from unlikely, irrelevant threats by... deliberately paying strangers to MiTM your traffic?

	▲	notaproton a day ago \| parent [-]
		[dead]