3 ms·
While its great that you have a spare $100 a year and the money to invest in Apple hardware to digitally sign Mac builds, not every project will have those reso
by JohnTHaller 10y ago
While its great that you have a spare $100 a year and the money to invest in Apple hardware to digitally sign Mac builds, not every project will have those resources. Projects that don't have the resources will often publish hashes so that users will be able to check to ensure their download is legitimate before using it. Handbrake does this: https://handbrake.fr/checksums.php https://handbrake.fr/checksums.php
- CamperBob2 10y agoHandbrake does this: https://handbrake.fr/checksums.php https://handbrake.fr/checksums.php And how's that been working out for them (and their users)?
- JohnTHaller 10y ago> And how's that been working out for them (and their users)? It likely worked out fine for anyone who checked the SHA256 before installing it. Which, unfortunately, is likely a small minority of users.
- ReligiousFlames 10y agoChecksums != signatures For free, the author could simply GPG sign all releases for all platforms and suggest users verify them. Then, the decision to run untrusted code is the user's decision and bypasses platform monetization. Then, if suffient and continual contributions of money and expertise permit, official codesigning per platform could be added as another layer (defense-in-depth).