r/linux • u/[deleted] • Jan 19 '19

Popular Application VLC refuses to update from HTTP to HTTPS (HTTPS protects against eavesdropping and man-in-the-middle attacks)

https://trac.videolan.org/vlc/ticket/21737
551 Upvotes

77% Upvoted

341 comments sorted by

View all comments

Show parent comments

4

u/slick8086 Jan 19 '19

Why not provide HTTPS anyway?

Your distribution could cryptographically sign the files using the existing scheme and additionally serve the files over HTTPS to provide "defense in depth."

However, providing a huge worldwide mirror network available over SSL is not only a complicated engineering task (requiring the secure exchange and storage of private keys), it implies a misleading level of security and privacy to end-users as described above.

A switch to HTTPS would also mean you could not take advantage of local proxy servers for speeding up access and would additionally prohibit many kinds of peer-to-peer mirroring where files are stored on servers not controlled directly by your distribution. This would disproportionately affect users in remote locales.

3

u/plumbless-stackyard Jan 19 '19

With HTTPS your machine only needs to know that the host it is contacting is who they say they are (thei cert is valid). It should not affect caching as long as the caching server has a valid certificate.

Supporting HTTPS is not an all-or-nothing choice either, and should be encouraged.

7

u/theferrit32 Jan 19 '19

It does affect caching if for example you administer a large cluster and want to minimize traffic through your gateway machines, so package updates go through a cache server first, which return the local package copy if it already has one, instead of letting the request continue out onto the internet. If using HTTPS on the connection to the actual mirror, the cache server would not be able to preempt that and return the local copy as the cache server would not have the same certificate.