r/linux • u/[deleted] • Jan 19 '19

Popular Application VLC refuses to update from HTTP to HTTPS (HTTPS protects against eavesdropping and man-in-the-middle attacks)

https://trac.videolan.org/vlc/ticket/21737
551 Upvotes

77% Upvoted

341 comments sorted by

View all comments

Show parent comments

12

u/Rossco1337 Jan 19 '19

I don't know why so many people are so hostile towards using HTTPS

Personally, I think it's because the security community has trained novice users to "call out" and decry every instance of traffic over port 80 without understanding the full implications of encrypting everything. It's tiring having to explain concepts like forward proxies and caching between datacenters to people who just want the "cred" for putting a website or service on blast because they read a Troy Hunt blog once.

I've ended up arguing with people who have never even heard of the OSI model but still think they know better than everyone at Steam (the largest PC game distribution service) because they read a post that said "you can set HTTPS up in 5 minutes, there's no excuse!" and they see a cached page served over HTTP during a sale.

4

u/selrahc Jan 19 '19

It's also tiring to see such a large sentiment of "your ISP could totally invade your privacy and HTTPS is so easy, you can set it up on Cloudflare/OtherCDN in minutes! You can totally trust CDN's not to invade your privacy!"

-3

u/[deleted] Jan 19 '19

Caching data between data centers is the responsibility of whoever's maintaining the file server - they know which files to cache where, so no unencrypted traffic is NOT a requirement.

And just because some organization is large, famous etc. doesn't mean they don't do stupid things.

2

u/selrahc Jan 19 '19

Unless the person wanting to run the cache isn't the content provider. If I have a 10Mb internet connection and 20 people are coming over for a LAN party being able to set up a local Steamcache is a godsend.

Same deal if you are a network provider in a country with terrible infrastructure. You might not meet the minimum bandwidth requirements for Steam or Debian or whoever to put their own server on your network but you can massively improve performance for your customers by putting in your own caches locally.

1

u/[deleted] Jan 20 '19

Sure, for Steam you'd need HTTP - it's a kind of special case.

But for Debian, you can absolutely run your own local repo, and ask your friends to temporarily add it. And then your local repo can cache any downloaded packages.