4 ms·
Why aren't curl binary downloads (and other binaries for that matter) served over HTTPS? HTTP seems like a fantastic man-in-the-middle opportunity.
by kristofferR 11y ago
Why aren't curl binary downloads (and other binaries for that matter) served over HTTPS? HTTP seems like a fantastic man-in-the-middle opportunity.
- mh- 11y agothey display an MD5 of the file right next to the download link, but that page is also served over plain HTTP.
- beefhash 11y agoMD5 isn't considered secure anymore in the first place; collisions have been found. See http://merlot.usc.edu/csac-f06/papers/Wang05a.pdf http://merlot.usc.edu/csac-f06/papers/Wang05a.pdf and http://www.win.tue.nl/~bdeweger/CollidingCertificates/ http://www.win.tue.nl/~bdeweger/CollidingCertificates/
- herbst 11y agoAltering a file that it still has the same MD5 hash is still rather unrealistic.
- zokier 11y agoThe word "MD5" does not appear anywhere on curl download page http://curl.haxx.se/download.html http://curl.haxx.se/download.html
- mh- 11y agoI somehow ended up getting sent to a mirror page when I went to download, which does have it. http://www.magicermine.com/demos/curl/curl/curl.html http://www.magicermine.com/demos/curl/curl/curl.html
- zokier 11y ago> The cURL project only provides source packages. All other packages are kindly provided by external persons and organizations. Some of the binaries are served over HTTPS, such as these https://bintray.com/vszakats/generic/curl/#files https://bintray.com/vszakats/generic/curl/#files