3 ms·
I get the thrust of the argument but I think this does gloss over some differences: > The web sites for Firefox, Rust, Google Chrome, and many others offer an
by IanCal 11y ago
I get the thrust of the argument but I think this does gloss over some differences:
> The web sites for Firefox, Rust, Google Chrome, and many others offer an HTTPS download as the primary installation mechanism. It’s even the standard way to install most Linux distros in the first place (by downloading an iso from the web site).
Yes, but these usually also come with checksums. If I can verify these through any other means I know that what someone else got was what I got too.
> Certificates on the old key expire in about a month. The auto-updater will begin using the new key as soon as it has installed an update that is aware of the new key.
I'm not sure I follow. Your key is compromised, you swap out for a new one, but this new one will only work after installing something signed with the compromised key?
Is there any way of updating the trusted keys before installing an update?
- zokier 11y ago> Yes, but these usually also come with checksums Checksums provide zero security benefit. You'd need signatures (like sandstorm.io provides) to actually protect against adversary modifying the installation media.
- IanCal 11y agoA checksum I can verify through a third source means I know I've got the same thing as they have. Signatures don't ensure that, unless I'm missing something.
- joosters 11y agoYes, but these usually also come with checksums. Checksums on the same site as the downloadable file are not that useful. If an attacker can replace the binary, they can also replace the checksum. If the checksum is on another site, it makes it more difficult as an attacker would have to break in to both sites.