> I don't quite understand the point concerning executable downloads and comparing hashes. Downloading a file from Server A and checking the hash delivered by

> I don't quite understand the point concerning executable downloads and comparing hashes. Downloading a file from Server A and checking the hash delivered by Server A is security theater. In this case, only a digital signature (with a pre-established public key that you already trust) can really stop the server from being compromised (or malicious). Downloading a file/torrent from Server B and verifying the hash delivered by Server A is a different situation entirely, and that boils down to a trust decision. Do you trust Server A to not be compromised? Do you trust them to not be malicious or in cahoots with Server B? If not, at the very least it's probably a larger attack service than the previous scenario. (Trusting the public key for the digital signature is also a trust decision. Only the details are different.) Basically: If you're going to do anything at all, verifying hashes from the same source is a waste of CPU and human effort. I hope that helps at all.