4 ms·

I reported the issue months ago [1], and I'm sure many have reported it before me. The devs have been ignoring the issue regardless of this particular author's

I reported the issue months ago [1], and I'm sure many have reported it before me. The devs have been ignoring the issue regardless of this particular author's tone. [1]: https://trac.videolan.org/vlc/ticket/21422 https://trac.videolan.org/vlc/ticket/21422

NicoJuicy 8y ago
The site is down. But a valid threat model was requested and not given by the original OP. If there was a post with a valid threat model. That would be interesting, until otherwise, it remains closed
- johnbellone 8y ago
  The threat was given by the comment, and a good community manager or developer would have acknowledged that and not have continued to act obstinate. They are actively ignoring it.
  - NicoJuicy 8y ago
    https://www.beauzee.fr/2017/07/04/videolan-and-https/ https://www.beauzee.fr/2017/07/04/videolan-and-https/ And you haven't read my comments here. Which said we don't know the whole story. Read the above link and don't believe everything you read online. I have given the developers of VLC the benefit of doubt. Rightfully, so it seems
- arkadiyt 8y ago
  My ticket was closed without requesting a threat model. As a trivial example this is a privacy leak - anyone on the network path can see what version you're upgrading to. It doesn't sound like a huge deal but we are moving to a 100% encrypted world, and it is a one character change to fix the issue. If VLC wants to keep the update over plaintext then they should justify why they want to do that, not have users justify why it should be over https. Instead, it feels like the VLC devs are having a kneejerk defensive reaction.
  - vbezhenar 8y ago
    You can check VLC website to know what’s the last version. It’s not a secret. While I don’t know the reason to prefer http over https, the only legitimate http threat is to serve non-latest version.
saurik 8y ago
Your issue is long after they were having this as an annoying argument version of the report (and it is really difficult to isolate "well this one guy might have sounded sane"; at some point you burn out even thinking about the issue). https://trac.videolan.org/vlc/ticket/11987 https://trac.videolan.org/vlc/ticket/11987
jbk 8y ago
Because the update is secured with GPG, not with the HTTP part.

NicoJuicy 8y ago

The site is down. But a valid threat model was requested and not given by the original OP. If there was a post with a valid threat model. That would be interesting, until otherwise, it remains closed

johnbellone 8y ago
The threat was given by the comment, and a good community manager or developer would have acknowledged that and not have continued to act obstinate. They are actively ignoring it.
- NicoJuicy 8y ago
  https://www.beauzee.fr/2017/07/04/videolan-and-https/ https://www.beauzee.fr/2017/07/04/videolan-and-https/ And you haven't read my comments here. Which said we don't know the whole story. Read the above link and don't believe everything you read online. I have given the developers of VLC the benefit of doubt. Rightfully, so it seems
arkadiyt 8y ago
My ticket was closed without requesting a threat model. As a trivial example this is a privacy leak - anyone on the network path can see what version you're upgrading to. It doesn't sound like a huge deal but we are moving to a 100% encrypted world, and it is a one character change to fix the issue. If VLC wants to keep the update over plaintext then they should justify why they want to do that, not have users justify why it should be over https. Instead, it feels like the VLC devs are having a kneejerk defensive reaction.
- vbezhenar 8y ago
  You can check VLC website to know what’s the last version. It’s not a secret. While I don’t know the reason to prefer http over https, the only legitimate http threat is to serve non-latest version.

saurik 8y ago

Your issue is long after they were having this as an annoying argument version of the report (and it is really difficult to isolate "well this one guy might have sounded sane"; at some point you burn out even thinking about the issue). https://trac.videolan.org/vlc/ticket/11987 https://trac.videolan.org/vlc/ticket/11987

jbk 8y ago

Because the update is secured with GPG, not with the HTTP part.