VoRS: Vo(IP) Simple Alternative to Mumble

> You have to verify downloaded tarballs authenticity to be sure that you retrieved trusted and untampered software.

I'm not able to access the site over TLS, so this is currently impossible. Anyone else have better luck?

    (from the installation instructions)

    $ [fetch|wget] http://www.vors.stargrave.org/download/.   vors-2.3.0.tar.zst
    $ [fetch|wget] http://www.vors.stargrave.org/download/vors-2.3.0.tar.zst.sig
    [verify signature]
    $ tar xf vors-2.3.0.tar.zst

Guarantees nothing, if you're actually being attacked. You can't serve out the tarball and the public key[0] and the signature insecurely and get any guarantees about authenticity.

[0]:http://www.vors.stargrave.org/PUBKEY-SSH.pub

I can see your point about a man-in-the-middle attack on HTTP, but realistically if the the attacker can do the MITM he can probably also figure out how to modify the contents on the webserver, in which case TLS does nothing

Most websites these days use Crimeflare or equivalent already anyways which is a MITM proxy, so you're still not safe there either.

> realistically if the the attacker can do the MITM he can probably also figure out how to modify the contents on the webserver, in which case TLS does nothing

Sorry, I don't see how that follows. If you had access to the webserver you would never even attempt a MITM attack in the first place.

Yes, however there's a big difference between Cloudflare and an arbitrary MITM. If you think Cloudflare is mangling traffic in a malicious way you would need a shred of evidence to substantiate that claim.

I would also push back that "most websites" use a 3rd party TLS terminating CDN/proxy layer in front of the actual webserver.

> If you think Cloudflare is mangling traffic

I'm more concerned with the data they receive being leaked or sold.

And by most websites I guess I meant large ones that people frequent every day, because these days it's almost impossible to have any sort of useful DDoS protection without using such a service.

> I'm more concerned with the data they receive being leaked or sold.

But that's not what we're talking about here. We were talking about a MITM attack on key/tarfile distribution in the context of verifying file integrity.