I saw VLC (Windows) gets updates from an unencrypted URL: HTTP, not HTTPS!
Do you think there's a risk for a man-in-the-middle attack?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
We can conclude:
In summary: VLC updates are safe for now, but the update mechanism should be upgraded to a state of the art algorithm, which does not necessitate HTTPS.