News for hackers. Stuff that matters.

A comment on VLC developers refuse to consider updates over HTTPS. Parent comment

Re:VLC developers refuse to consider updates over HTTPS by userbinator on Saturday January 19, 2019 @01:48PM (#18948494)
I remember when Microsoft released Win7 the ISOs were downloadable through HTTP direct links, and MS published the hashes on an HTTPS page. Similar idea, different implementation... and if cryptographic signing is good enough for a company like Microsoft, it should be good enough for VLC.
[ Parent | on HN ]
Re:VLC developers refuse to consider updates over HTTPS by dcbadacd on Saturday January 19, 2019 @01:49PM (#18948501)
I really do not agree with any arguments that are just saying "they're doing it, so may I".
[ Parent | on HN ]
Re:VLC developers refuse to consider updates over HTTPS by NicoJuicy on Saturday January 19, 2019 @01:51PM (#18948510)
Perhaps he's saying: Microsoft didn't find a threat model. The VLC developers had the same conclusion.

So the issue should still be closed according to the supplied information in the bug post submission.

[ Parent | on HN ]