It's fixed now.
Before it worked.
It seems like it's fixed now, but if possible use one of the mirrors, so everyone's not hitting that one server all that hard, it's usually faster too.
Or even better, use the torrent.
this post was submitted on 25 Jan 2025
57 points (90.1% liked)
Linux
49323 readers
2126 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
If you go to the mirrors page you’ll see cdimage.debian.org under Sweden and it’s an http link. My guess is that the link is just misconfigured on the home page. It’s helpful to avoid https for things like this because it allows you to download updates on machines with outdated security software, eg TLS 1.0/1.1.
I see this too and it’s caused by the actual server not having a certificate belonging to the domain. It’s likely a configuration problem (and okay) but I don’t like to take chances.
If they offer a torrent, perhaps it’s better to use that for now.
You can download it over http and check the SHA256SUMS.
Or better yet torrent it and check the same sha256
I can't remember if it was always like that or not, but all the apt repos are the same. No SSL and verification via signing.
Apt repos are like that for several reasons, one of which is that it allows DNS based mirroring without having to share a certificate. Another is that back when apt started out, HTTPS was pretty rare.
It's the download link on the fort page of debian.org. Has it always been like that.
That's incorrect there's full SSL on deb.debian.org
It seems like an odd choice if it's not a mistake to put it on the first page and it's not just a HTTP warning it's an SSL warning that appears quite scary on Chromium browsers.
But cool to know that apt repos don't use SSL i knew they verified via signature but fought they had both.
Torrent programs already do checking hash checksums to determine if you got it 100%
thats also the only reason to check your download with a provided hash checksum from a website... to check the intigrity of the download and not for safety reasons
Torrents verify that the data they downloaded is correct.
That doesn't mean the data that was used to create the torrent was correct. In this case I suggested downloading via torrent (because of http) and then checking the sha from the website to verify everything matches. If it does they you've got a good iso!