4 ms·
they display an MD5 of the file right next to the download link, but that page is also served over plain HTTP.
by mh- 11y ago
they display an MD5 of the file right next to the download link, but that page is also served over plain HTTP.
- beefhash 11y agoMD5 isn't considered secure anymore in the first place; collisions have been found. See http://merlot.usc.edu/csac-f06/papers/Wang05a.pdf http://merlot.usc.edu/csac-f06/papers/Wang05a.pdf and http://www.win.tue.nl/~bdeweger/CollidingCertificates/ http://www.win.tue.nl/~bdeweger/CollidingCertificates/
- herbst 11y agoAltering a file that it still has the same MD5 hash is still rather unrealistic.
- zokier 11y agoThe word "MD5" does not appear anywhere on curl download page http://curl.haxx.se/download.html http://curl.haxx.se/download.html
- mh- 11y agoI somehow ended up getting sent to a mirror page when I went to download, which does have it. http://www.magicermine.com/demos/curl/curl/curl.html http://www.magicermine.com/demos/curl/curl/curl.html