:|
Well, regardless of exploitability, this attitude just destroyed any confidence I had in VLC's updater being secure. Seriously, WTF. https://trac.videolan.org/vlc/ticket/21737 …
-
-
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Please formulate your threat model in the form of a tweet.
-
New conversation -
-
-
There is a reddit post about this, Someone mentioned that the update is signed and checked against a harcoded value in VLC... They also mentioned something about http being cache able? Sounds to me they use the same method as apt for verification.
-
Which isn't a particularly good one, because it's subject to downgrade attacks. HTTPS fixes that. Also apparently the key is 1024-bit dsa, which, like, what.
- Show replies
New conversation -
-
-
This Tweet is unavailable.
-
It's rather "the update is signed and we think we covered all basis. Can you provide us with one avenue we may have missed that would justify this non-trivial change?"
- Show replies
-
-
-
I stopped using VLC years ago once it was clear they had no interest in fixing their surround sound issues. Since I use Windows on my media PC, a friend recommended PotPlayer (http://potplayer.daum.net ) and I’ve been happy ever since. Not sure how it handles updates though…
-
Update story aside, if you want a quality first-choice video player, pick something from this list: https://github.com/mpv-player/mpv/wiki/Applications-using-mpv …
- Show replies
New conversation -
-
-
that's ridiculous! bad attitude is the number one killer for contribution.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.