4 ms·
Wouldn't it make more sense to sign the binary then?
by martinknafve 9y ago
Wouldn't it make more sense to sign the binary then?
- alexchantavy 9y agoYeah, really silly that the legitimate binary for Handbrake isn't signed. Sure, if the intruder had compromised the hosting server then they might have also compromised the signing cert, but that's still an extra step.
- marcosdumay 9y agoAren't both the same thing? How else can you sign a binary?
- martinknafve 9y agoOP was referring to creating a hash, signing the hash and publish the signed hash on the web site. The alternative would be to sign the actual binary file using code signing (internally I assume that relies on a hash ).