Top all-time · #25654
Chouquette
Personal blog · beauzee.frprogrammingsystems
Chouquette is a personal blog at beauzee.fr about programming and systems. Since 2019, 3 different Hacker News readers have linked it 6 times. The last post was in 2017, but the archive is still widely read.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN readers link this post to explain why VLC does not use HTTPS for updates, citing the difficulty of forcing HTTPS on third-party mirrors. It comes up in threads on APT and VLC security.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Thoughts, rants, and articles from a VLC developer
Most-linked posts?
- /2017/07/04/videolan-and-https/3 people · 6 mentions · first linked 2019-01-21
What Hacker News says?
> Please stop calling it “hysteria”. From https://www.beauzee.fr/2017/07/04/videolan-and-https/ : > If you use homosexuality in order to insult/make fun of someone, it is homophobic. You might disagree, but that’s irrelevant. It is. Calling members of the projet on their personal phones and insulting them is probably a bit of an overreaction, don’t you think?
Comment linking /2017/07/04/videolan-and-https/
on “Why does APT not use HTTPS?”Here is why Videolan (VLC) doesn't do it: https://www.beauzee.fr/2017/07/04/videolan-and-https/ There were some topics about it yesterday. Eg. https://news.ycombinator.com/item?id=18948195 Some arguments of the blog post are also valid here
Comment linking /2017/07/04/videolan-and-https/
on “Why does APT not use HTTPS?”It seems the last days some people are actively looking for http downloads. Videolan and apt/get now. Here is why videolan doesn't do it: https://www.beauzee.fr/2017/07/04/videolan-and-https/ TLDR; They can't force HTTPS to 3rd parties, which is why they can't do it. It's not as simple as running LE.
Comment linking /2017/07/04/videolan-and-https/
on “Remote code execution vulnerability in apt/apt-get”VLC have a past with "security-asshole" that could explains why JB seems tired with some members of the infosec community in general. From what I've read from the past controversies, each time a security issue arises in VLC the team is attacked by an angry mob of infosecs. This blog post closing remarks summarize the recurring issue well: https://www.beauzee.fr/2017/07/04/videolan-and-https/
Comment linking /2017/07/04/videolan-and-https/
on “VLC 3.0.7 and security”Here is a decent developer response: https://www.beauzee.fr/2017/07/04/videolan-and-https/
Comment linking /2017/07/04/videolan-and-https/
on “VLC developers refuse to consider updates over HTTPS”https://www.beauzee.fr/2017/07/04/videolan-and-https/ And you haven't read my comments here. Which said we don't know the whole story. Read the above link and don't believe everything you read online. I have given the developers of VLC the benefit of doubt. Rightfully, so it seems
Comment linking /2017/07/04/videolan-and-https/
on “VLC developers refuse to consider updates over HTTPS”