Download Link Legitimacy

[Rob Walker]

Hello! 

Our Firewalls need to be changed to allow traffic when download links change which can be time consuming.  We currently have 4 x 403 errors for changed download links.  A couple of question arising:

From a security standpoint, Why are PMPC not obtaining these downloads from source instead of Mirrors? 

Are the links below legitimate mirrors and if so how often are these links likely to change?

An error occurred WebClient reported an error during download (https://the.earth.li/~sgtatham/putty/0.82/w64/putty-64bit-0.82-installer.msi): The remote server returned an error: (403) Forbidden.
 
An error occurred WebClient reported an error during download (https://the.earth.li/~sgtatham/putty/0.82/w32/putty-0.82-installer.msi): The remote server returned an error: (403) Forbidden
 
An error occurred WebClient reported an error during download (https://mirror.fcix.net/videolan-ftp/vlc/3.0.20/win32/vlc-3.0.20-win32.msi): The remote server returned an error: (403) Forbidden.
 
An error occurred WebClient reported an error during download (https://mirror.fcix.net/videolan-ftp/vlc/3.0.20/win64/vlc-3.0.20-win64.msi): The remote server returned an error: (403) Forbidden.

Thanks,  Rob 

[nithin]

Hello Rob,

We typically use direct sources for most vendors. However, some vendors provide time-expiring links, location-based links, or web pages that use JavaScript to generate download links for users.

For example, the VLC web page offers the link https://get.videolan.org/vlc/3.0.21/win32/vlc-3.0.21-win32.exe, which always redirects to a random mirror.

We choose a mirror in advance so that we can provide a definitive list of domains that need to be unblocked or whitelisted.

You can find the list of domains used for downloads in the Patch My PC update catalog here:
https://patchmypc.com/list-of-domains-used-for-downloads-in-patch-my-pc-update-catalog

[Rob Walker]

Thanks for that!  Will pass on to our Cyber guys