Well, regardless of exploitability, this attitude just destroyed any confidence I had in VLC's updater being secure. Seriously, WTF. https://trac.videolan.org/vlc/ticket/21737 …
-
There is a reddit post about this, Someone mentioned that the update is signed and checked against a harcoded value in VLC... They also mentioned something about http being cache able? Sounds to me they use the same method as apt for verification.
Which isn't a particularly good one, because it's subject to downgrade attacks. HTTPS fixes that. Also apparently the key is 1024-bit dsa, which, like, what.
-
-
VLC updater forbids downgrades.
-
The only issue is privacy, but we'd need to live in a post-DTLS/DoH for that.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.