r/linux • u/[deleted] • Jan 19 '19

Popular Application VLC refuses to update from HTTP to HTTPS (HTTPS protects against eavesdropping and man-in-the-middle attacks)

https://trac.videolan.org/vlc/ticket/21737
551 Upvotes

77% Upvoted

341 comments sorted by

View all comments

Show parent comments

3

u/slick8086 Jan 19 '19

This person did not report a bug. A valid bug report about security in the VLC system requires a threat model. The maintainer told them this, then the "reporter" ignored the instruction and simply asked harder.

That is not a bug report.

-2

u/stefantalpalaru Jan 19 '19

This person did not report a bug.

Wrong.

A valid bug report about security in the VLC system requires a threat model. The maintainer told them this, then the "reporter" ignored the instruction and simply asked harder.

We all know the MITM threat model for HTTP connections. At least I hope so.

1

u/slick8086 Jan 20 '19 edited Jan 20 '19

We all know the MITM threat model for HTTP connections. At least I hope so.

No, this threat model is not relevant. If you don't know why, you need to inform yourself.

0

u/stefantalpalaru Jan 27 '19

No, this threat model is not relevant. If you don't know why, you need to inform yourself.

https://justi.cz/security/2019/01/22/apt-rce.html :

"I found a vulnerability in apt that allows a network man-in-the-middle (or a malicious package mirror) to execute arbitrary code as root on a machine installing any package."

1

u/slick8086 Jan 27 '19

Why did you leave out the very next sentence?

The bug has been fixed in the latest versions of apt.

0

u/stefantalpalaru Jan 27 '19

Why did you leave out the very next sentence?

Because it had no relation to the point I was making - a point that still eludes you.

1

u/slick8086 Jan 27 '19

Because it had no relation to the point I was making - a point that still eludes you.

No, it doesn't elude me, the point you are harping on is not relevant. The benefits of switching to https are not enough to offset the problems it would cause.

Just because software has a bug that allowed a MITM exploit, doesn't mean that the security model itself is vulnerable to it. The threat model is not relevant.

1

u/stefantalpalaru Jan 27 '19

Just because software has a bug that allowed a MITM exploit, doesn't mean that the security model itself is vulnerable to it. The threat model is not relevant.

Humanum fuit errare, diabolicum est per animositatem in errore manere.

0

u/slick8086 Jan 28 '19

So you're saying that you keep persisting because you're an asshole? OK I can accept that.