Re:VLC developers refuse to consider updates over HTTPS
by dcbadacd on Saturday January 19, 2019 @01:54PM
(#18948522)
They do, with 1024bit DSA with SHA1. Cryptographically weak and forbidden by the NIST.
[ Parent
| on HN ]
Re:VLC developers refuse to consider updates over HTTPS
by jjeaff on Saturday January 26, 2019 @05:55PM
(#19009103)
While yes, it is considered weak, that doesn't mean it is useless. Git uses Sha1 and a lot of other services do as well. Using it to validate and sign an update is probably still pretty much safe as I have only ever seen or heard of a single SHA1 collision ever. And that was in 2017. It took them 6500 years of CPU computation time and 110 years of GPU computation time to find it. I think we can consider SHA1 good enough to sign VLC updates for now.
https://security.googleblog.com/2017/02/announcing-first-sha...