Hector Martin

There is a reddit post about this, Someone mentioned that the update is signed and checked against a harcoded value in VLC... They also mentioned something about http being cache able? Sounds to me they use the same method as apt for verification.

Which isn't a particularly good one, because it's subject to downgrade attacks. HTTPS fixes that. Also apparently the key is 1024-bit dsa, which, like, what.

VLC updater forbids downgrades.

Does it do it securely? Even if it does (big if), nothing can forbid upgrades to a vulnerable-not-latest version. That is fixed by HTTPS.

It is not fixed by HTTPS. It ALSO requires changes to the update mechanism to achieve this. Which requires the transition to a new update model, which is not simple.

Of course it's fixed by HTTPS. If you use HTTPS, I can't serve any updates at all without compromising your server. I can only block the process altogether, which is not upgrade-to-vulnerable.

Assuming you're doing https correctly (i.e. pinning, or at least root verification), which is also a big assumption :)

and revocation and CA validation, et caetera...