4 ms·

He's talking about ISO images, though.

by jgome 10y ago

oliwarner 10y ago
Me too (in part, though I missed the word "hash"). Natural collisions exist but it's bloody hard work to force a collision on a modified 800MB binary file. That's well before you consider the group security of torrents (hashed chunks, optional SSL on tracker, etc). It's easier to distract somebody and get physical access to their computer.
- AgentME 10y ago
  I'm not really following you at all. I just went to download the Ubuntu ISO. Everything was over HTTP, and I was not instructed to use or even offered any gpg signatures. I didn't see anything about hashes (which would need to be signed or offered over HTTPS to mean anything).
  - oliwarner 10y ago
    The page you went through [1], contains this: > Verify your download - If you want to verify the data integrity and authenticity of your Ubuntu download, follow our guide. Learn how to verify [2] › Yes, this could be more prominent. Yes, this download could be offered over SSL. Yes, ubuntu.com should definitely force-on SSL (rather than force-off). But these don't equate to a process that is impossible to securely verify. You can. The SHA and MD5 checksums are both GPG-signed [3]. [1]: http://www.ubuntu.com/download/desktop/thank-you?country=GB&version=16.04&architecture=amd64 http://www.ubuntu.com/download/desktop/thank-you?country=GB&... [2]: http://www.ubuntu.com/download/how-to-verify http://www.ubuntu.com/download/how-to-verify [3]: http://releases.ubuntu.com/16.04/ http://releases.ubuntu.com/16.04/
    - sliken 10y ago
      Heh, kinda amusing to claim you can verify the ISO, then to verify you post 3 URLs that are easy to MiTM because they are not using HTTPS. For those that care I suggest: https://help.ubuntu.com/community/VerifyIsoHowto https://help.ubuntu.com/community/VerifyIsoHowto It's over HTTPs, and mentions both the short finger prints (0xFBB75451 and 0xEFE21092) as well as the full finger prints (C598 6B4F 1257 FFA8 6632 CBA7 4618 1433 FBB7 5451 and 8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092).
      - oliwarner 10y ago
        The hash-GPGs are securely verifiable. The community wiki page is editable. Obvious issues there.

He's talking about ISO images, though.

by jgome 10y ago

He's talking about ISO images, though.

Me too (in part, though I missed the word "hash"). Natural collisions exist but it's bloody hard work to force a collision on a modified 800MB binary file. That's well before you consider the group security of torrents (hashed chunks, optional SSL on tracker, etc). It's easier to distract somebody and get physical access to their computer.

AgentME 10y ago
I'm not really following you at all. I just went to download the Ubuntu ISO. Everything was over HTTP, and I was not instructed to use or even offered any gpg signatures. I didn't see anything about hashes (which would need to be signed or offered over HTTPS to mean anything).
- oliwarner 10y ago
  The page you went through [1], contains this: > Verify your download - If you want to verify the data integrity and authenticity of your Ubuntu download, follow our guide. Learn how to verify [2] › Yes, this could be more prominent. Yes, this download could be offered over SSL. Yes, ubuntu.com should definitely force-on SSL (rather than force-off). But these don't equate to a process that is impossible to securely verify. You can. The SHA and MD5 checksums are both GPG-signed [3]. [1]: http://www.ubuntu.com/download/desktop/thank-you?country=GB&version=16.04&architecture=amd64 http://www.ubuntu.com/download/desktop/thank-you?country=GB&... [2]: http://www.ubuntu.com/download/how-to-verify http://www.ubuntu.com/download/how-to-verify [3]: http://releases.ubuntu.com/16.04/ http://releases.ubuntu.com/16.04/
  - sliken 10y ago
    Heh, kinda amusing to claim you can verify the ISO, then to verify you post 3 URLs that are easy to MiTM because they are not using HTTPS. For those that care I suggest: https://help.ubuntu.com/community/VerifyIsoHowto https://help.ubuntu.com/community/VerifyIsoHowto It's over HTTPs, and mentions both the short finger prints (0xFBB75451 and 0xEFE21092) as well as the full finger prints (C598 6B4F 1257 FFA8 6632 CBA7 4618 1433 FBB7 5451 and 8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092).
    - oliwarner 10y ago
      The hash-GPGs are securely verifiable. The community wiki page is editable. Obvious issues there.