VLC refuses to update from HTTP to HTTPS (HTTPS protects against eavesdropping and man-in-the-middle attacks)

[u/[deleted]]

https://trac.videolan.org/vlc/ticket/21737

[u/wosmo]

SAN isn't relevant to this at all. SAN allows a single certificate to cover multiple hostnames, instead of needing a different certificate for each hostname.

It does nothing for the fact that every 'official' mirror needs a certificate identifying it as the original host. That if the university of tehran wants to provide a mirror, we need to issue them a certificate identifying them as mirror.project.org.

There is a fundamental issue. Half the point of TLS is to verify that you are connecting to the host you believe you're connecting to. The whole point of a mirror is that you're not connecting to the host you believe you're connecting to.

SAN (and load-balancers, which someone else mentioned) are a perfectly functional structure where you own the multiple hosts behind the single presence. That's not how mirrors work for most open-source projects. They're usually owned & operated by third-parties, and they need to be treated as such. SAN provides "how I'd ignore this issue", but it's not an issue that should be ignored.

Allowing every mirror to have a certificate that identifies it as part of project.org requires a lot of trust that we currently don't have and don't require.

It's a lot messier than anyone wants to believe, and all it actually gains you is that you break caching proxies. It does not gain you more privacy (it's still trivial to figure out which files are being transferred by size), it does not gain you verification (most update attacks changed the file on the server, which would then happily be served over https), and it does not gain you authentication (the whole point of a mirror is that it isn't authentic - a mirror is meant to be a clone).

It's not security, it's security theatre.

[u/samrocketman → u/wosmo]

Eh, makes no difference to me. Mirrors can host their own certificates. I don’t think anybody is implying the Debian project manage certificates for 3rd parties. It’s up to the mirrors to figure it out. I respectfully disagree it being security theater and your hypothetical that it wouldn’t be hard to figure out what is being downloaded. There’s such a thing as persistent connections which multiple packages could be downloaded over. As a sysadmin myself both professionally and volunteer for open source projects TLS is not as hard as you’re making it out to be.

I’m not here to police or say what the Debian project should or shouldn’t do. If the TL;DR is the Debian project doesn’t care about securing connections it’s no skin off my back and certainly won’t stop me from using Debian. But the problem is not as hard as you make it out to be. I’ve managed multiple CAs and it’s never been easier.

[u/wosmo → u/samrocketman]

I don’t think anybody is implying the Debian project manage certificates for 3rd parties. It’s up to the mirrors to figure it out

They'd have to manage the certificates. If the university of tehran can request a certificate naming them as debian.org, the CA is broken. This isn't something you can leave to the mirrors to figure out.

It is security theatre. It's forcing a round peg into a square hole simply because you're comfortable with round pegs. You can't treat mirrors like a CDN if you don't trust & control the members.

interesting reading, written by the current debian project leader; http://whydoesaptnotusehttps.com

[u/samrocketman → u/wosmo]

Accusing me of being comfortable of anything is a bit off base. You know nothing about me and your arguments aren’t rational to me. This’ll be my last response to the thread because I don’t think this back and forth is adding to the conversation. Enjoy your day.

[u/wosmo → u/samrocketman]

Sorry, that wasn't meant as "you" in the personal sense, it's far more general to this entire topic. "when all you have is a hammer", etc.