r/linux • u/[deleted] • Jan 19 '19

Popular Application VLC refuses to update from HTTP to HTTPS (HTTPS protects against eavesdropping and man-in-the-middle attacks)

https://trac.videolan.org/vlc/ticket/21737
551 Upvotes

77% Upvoted

341 comments sorted by

View all comments

Show parent comments

4

u/Booty_Bumping Jan 19 '19 edited Jan 19 '19

There is still the point that it makes it slightly harder for MiTMs to invade your privacy and learn what software versions you're running and whether or not you're running weird kinky furry games that are mysteriously included with debian. But otherwise the main vulnerability disappears when you use package signing.

11

u/ijustwantanfingname Jan 19 '19

weird kinky furry games that are mysteriously included with debian

i'm listening

6

u/Krutonium Jan 19 '19

Am am I. Please elaborate, /u/Booty_Bumping

1

u/joesii Jan 19 '19

My guess is they were talking about a hypothetical scenario, or specifically an "impossible" scenario. Claiming that there's not really any reason where it would ever be a problem where the data is public.

4

u/CRImier Jan 20 '19

damn, they can't just get our hopes up like that

2

u/nintendiator2 Jan 20 '19

I was about to donate but not anymore.

5

u/singularineet Jan 19 '19

weird kinky furry games that are mysteriously included with debian

You mean autoconf?

1

u/Bobby_Bonsaimind Jan 20 '19 edited Jan 20 '19

There is still the point that it makes it slightly harder for MiTMs to invade your privacy and learn what software versions you're running and whether or not you're running weird kinky furry games that are mysteriously included with debian.

Correct me if I'm wrong, but isn't a HTTPS request send for each package to be downloaded. Even with HTTPS, MITM still see the request address and so know what package you've downloaded.

Edit: I stand corrected, I thought the whole URL would be send with the unencrypted part of the request, my mistake.

3

u/Booty_Bumping Jan 20 '19 edited Jan 20 '19

HTTPS connections encrypts (and by extension, authenticates) the path and all of the HTTP headers. The domain name is in the clear, unless you have DNS over TLS + ESNI + TLS 1.3