Vulnerability of OpenSource Software download mechanisms: VLC

[admin at pilobilus.net (Steve Kinney)]

On 07/03/2017 08:36 AM, Fabio Pietrosanti - Lists wrote:
> Hello,
> 
> as we move to improve the status of encryption of the internet and at
> all levels internet companies diffuse the uses of HTTPS encryption and
> integrity protection methods there are still a variety of massively
> diffused pieces of software that can be subject to malware injection
> trough MITM techniques.
> 
> VLC, Videolan Client, the most used opensource video player have their
> entire website in HTTP, their download page in HTTP and the mirror
> providing the downloading in HTTP.
> 
> However they are refusing to implement HTTPS arguing that because their
> .exe are digitally signed with authenticode they are safe 
> https://trac.videolan.org/vlc/ticket/18472 .