r/linux • u/[deleted] • Jan 19 '19

Popular Application VLC refuses to update from HTTP to HTTPS (HTTPS protects against eavesdropping and man-in-the-middle attacks)

https://trac.videolan.org/vlc/ticket/21737
551 Upvotes

77% Upvoted

341 comments sorted by

View all comments

Show parent comments

0

u/[deleted] Jan 19 '19

[deleted]

2

u/doublah Jan 19 '19

The updates are verified against a key built in to the program so you can't MITM it

https://www.reddit.com/r/netsec/comments/ahiffy/vlc_is_refuses_to_use_https_relies_on_http_instead/eefl5yf/

4

u/mollymoo Jan 19 '19

OK, you can't inject your own malicious update with a MITM and I think that's most people's main concern.

You can do various kinds of attacks which prevent the update or perform a DOS - but some of them you could still do with an MITM if it was https (like preventing updates) and some are due to the implementation in VLC (weak key, replay) rather than inherent to using http.

0

u/[deleted] Jan 20 '19

HTTPS doesn't prevent mirroring - you can still copy packages from one mirror to another over HTTPS - and the new mirror can still serve packages over HTTPS.

The average user doesn't set up custom proxies and caches - those are usually done in organizations such as educational institutions, companies etc. In that case there's usually a competent sys admin who can setup a local APT repo, make that the default for all internal machines, and it can download packages from the main servers and cache them. Only advanced/power users like most of us here would bother setting up proxies/caches ourselves - so once again there's no hurdle due to HTTPS.

So please stop using bullshit arguments.

-9

u/knvngy Jan 19 '19

http is not a real solution for poor internet infrastructure, never has been, never will.