Subject: Re: bug#21382: [PATCH] Use HTTPS for package repo URLs

From: Glenn Morris <[email-masked]>
Date: Mon, 31 Aug 2015 12:02:09 -0400

Hi,

Francois Marier wrote:

> In order to avoid having users pull emacs packages over HTTP (where they can
> be intercepted and modified by network attackers),

elpa.gnu.org packages are gpg signed, which should prevent such modification.

> I have changed the default URLs for the package repositories to use HTTPS.

Thanks for the patch, but more is needed than just unconditionally
changing http to https. See discussion in

http://lists.gnu.org/archive/html/emacs-devel/2015-05/msg00110.html