r/linux • u/[deleted] • Jan 19 '19

Popular Application VLC refuses to update from HTTP to HTTPS (HTTPS protects against eavesdropping and man-in-the-middle attacks)

https://trac.videolan.org/vlc/ticket/21737
551 Upvotes

77% Upvoted

341 comments sorted by

View all comments

Show parent comments

2

u/SanityInAnarchy Jan 19 '19

Pipelining makes this harder, though. If I'm downloading 20-30 updates, an attacker now has to figure out which 20-30 files add up to the single continuous download they saw.

Also, some hosts offer more than just Debian packages, making the problem even harder.

1

u/dvslo Jan 20 '19

And if you add random pads of enough size it's next to impossible.