4 ms·
Things to keep in mind: - In the US, the CFAA has language that may or may not be relevant [1]. This isn't intended to be FUD, although I can understand if you
by niftich 10y ago
Things to keep in mind:
- In the US, the CFAA has language that may or may not be relevant [1]. This isn't intended to be FUD, although I can understand if you think so. As with most legal things, don't believe me -- a random guy -- on the internet; ask a lawyer, or at the very least be aware of your risks.
- Check license and terms, if included. Reddit post claims these [2] are terms, seems okay, but I have not confirmed this for myself.
- FTP is unencrypted and non-tamperproof, so data integrity and data authenticity, and connection privacy isn't guaranteed. And because the original source did not publish checksums over a secure channel, there is no way to know whether these files are the originals. It will be difficult to prove the provenance and accuracy of the data, despite having lots of third-party copies, without the original source having safeguarded the strong cryptographic checksums the entire time, or having published them over a tamperproof channel.
[1] https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030 [2] https://www.reddit.com/r/DataHoarder/comments/5q4xxe/erik_fichtner_on_twitter_please_wget_m_np/dcwo823/ https://www.reddit.com/r/DataHoarder/comments/5q4xxe/erik_fi...
- jMyles 10y ago> strong cryptographic checksums They needn't even be strong, right? Even a weak checksum on a data set of this size is basically collision-proof, no?
- niftich 10y agoIt absolutely needs to be a strong cryptographic hash, because you want to protect against both deliberate tampering and accidental modification. Any other function, whether non-cryptographic, too short, broken or having known weaknesses, while perhaps suitable to detect accidental corruption, will not protect against the former. For example, SHA-384, or SHA-3 are great choices.
- jMyles 10y agoGotcha. TIL.
- Dylan16807 10y agoThough this isn't a case that needs to be append-proof, so SHA-256 is fine.