3 ms·
I usually check the hashes of all software I download. How do I check the hash if the vendor doesn't publish it, you might ask? Simple, calculate it and Google
by ambrop7 10y ago
I usually check the hashes of all software I download.
How do I check the hash if the vendor doesn't publish it, you might ask? Simple, calculate it and Google it. If you find what look like legitimate hits associating this file with this hash, call it good.
And it does work in this case - try googling both the published good and bad hash :)
- ultramancool 10y agoIn this case a distribution site which hosts both the hash and the file was hacked. This test is only good for "is the integrity of the download good" not for "is this created by the original developer". An authenticode or PGP signature is much better.
- ambrop7 10y agoIt is good if the compromise is not large-scale or is recent (e.g. only one of the mirrors was compromised, or the compromise is recent enough that search engines and such don't know much about the hacked version).