4 ms·
There's a good chance that someone who can modify your base image can also modify the checksum you're showing to whatever is the new checksum. For example, whe
by r3bl 7y ago
There's a good chance that someone who can modify your base image can also modify the checksum you're showing to whatever is the new checksum.
For example, when Linux Mint's ISOs were briefly backdoored, the attackers also changed the checksum shown on the website: https://www.zdnet.com/article/hacker-hundreds-were-tricked-into-installing-linux-mint-backdoor/ https://www.zdnet.com/article/hacker-hundreds-were-tricked-i...
- jjeaff 7y agoBut that's not the point here. The point is that you choose an image and verify that it is safe and then pin the hash. So I can pull that hash a thousand times over from whatever source I want and I can be sure it is always the same image that 8 originally verified. I don't care who has it or who now has control over the site because if the image doesn't match the hash, then it isn't mine.