4 ms·
The site is down. But a valid threat model was requested and not given by the original OP. If there was a post with a valid threat model. That would be interes
by NicoJuicy 8y ago
The site is down. But a valid threat model was requested and not given by the original OP.
If there was a post with a valid threat model. That would be interesting, until otherwise, it remains closed
- johnbellone 8y agoThe threat was given by the comment, and a good community manager or developer would have acknowledged that and not have continued to act obstinate. They are actively ignoring it.
- NicoJuicy 8y agohttps://www.beauzee.fr/2017/07/04/videolan-and-https/ https://www.beauzee.fr/2017/07/04/videolan-and-https/ And you haven't read my comments here. Which said we don't know the whole story. Read the above link and don't believe everything you read online. I have given the developers of VLC the benefit of doubt. Rightfully, so it seems
- arkadiyt 8y agoMy ticket was closed without requesting a threat model. As a trivial example this is a privacy leak - anyone on the network path can see what version you're upgrading to. It doesn't sound like a huge deal but we are moving to a 100% encrypted world, and it is a one character change to fix the issue. If VLC wants to keep the update over plaintext then they should justify why they want to do that, not have users justify why it should be over https. Instead, it feels like the VLC devs are having a kneejerk defensive reaction.
- vbezhenar 8y agoYou can check VLC website to know what’s the last version. It’s not a secret. While I don’t know the reason to prefer http over https, the only legitimate http threat is to serve non-latest version.