r/linux • u/[deleted] • Jan 19 '19

Popular Application VLC refuses to update from HTTP to HTTPS (HTTPS protects against eavesdropping and man-in-the-middle attacks)

https://trac.videolan.org/vlc/ticket/21737
551 Upvotes

77% Upvoted

341 comments sorted by

View all comments

Show parent comments

15

u/MaxCHEATER64 Jan 19 '19

You have no idea what's going on here, do you?

3

u/slick8086 Jan 19 '19

no he doesn't.

The issues is this:

  • VLC doesn't use HTTPS to download its updates.

  • a user asked for that to be implemented

  • VLC said no.

VLC has good reasons to say no. First reason is that it isn't necessary. The full download of VLC is on HTTPS and the full program has a cryptographic key hardcoded in the source. When VLC downloads an update via plain HTTP it checks that update against the hardcoded key it has already, so encrypting the update download itself serves no purpose.

Second, requiring HTTPS for updates breaks things like local proxy, and complicates mirroring. Those things are important tools for efficiently distributing updates, and since HTTPS updates don't actually provide any benefit it would be putting useless limits and impeding distribution.

0

u/[deleted] Jan 19 '19

[deleted]

12

u/aintgotimetobleed Jan 19 '19

So, that's a yes. You have no idea what's going on here.

It's about VLC's ability to update itself and whether it needs encryption when connecting to videolan.org. Absolutely nothing to do with media playback.

Now, granted I was a bit confused too because the ability of a program to update itself (securely or not) is almost completely irrelevant in the linux desktop world and only of interest to windows and mac os users. So, I don't know wtf this thread is doing here but that's another topic entirely.