4 ms·

>Installing random binaries used to be a bad thing, now it's outright encouraged. "Thanks for using our toilet. Download our app to unlock the door!" It's surp

>Installing random binaries used to be a bad thing, now it's outright encouraged. "Thanks for using our toilet. Download our app to unlock the door!" It's surprising to me how rarely even reputable companies provide hashes/signatures. I just downloaded a Windows virtual machine that MS offers for free[1]. No sha256 sum, no pgp signature. I ended up deciding that since it it served over HTTPS from an MS controlled domain that I'd accept the risk, but I wish more vendors would allow advanced users to verify downloads. (MS is not alone in this, many, many open source projects offer up pre-compiled binaries with zero checksum info, which especially sucks since so often they rely on an assortment of mirrors for the binaries rather than a central location) I understand that telling users to fire up the CLI may be a pain point, but offering the information as an optional step for the experienced user should be a best practice IMHO. [1]For the interested, seems to last "only" 30 days but you can roll back to a snapshot if you're just testing compatibility of sites with Edge: https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ https://developer.microsoft.com/en-us/microsoft-edge/tools/v...

ben_w 7y ago
I’ve been around long enough to remember when people thought that sort of thing was a particular flaw of closed-source, but Ubuntu is failing in a similar way, as this unfixed bug from 2014 (confirmed and with multiple duplicates) demonstrates: https://bugs.launchpad.net/ubuntu/+bug/1359836 https://bugs.launchpad.net/ubuntu/+bug/1359836 Call me cynical, but this is what I expect to see if a government had ordered them to allow certain forms of interference with the OS. I don’t know enough to eliminate any other possibility, but it certainly smells fishy.
- dontbenebby 7y ago
  Wait, am I reading this bug correctly: even if I have HTTPS everywhere installed to force the S in errant urls, it would still go over HTTP? Because... "we provide the signatures"? Yikes.
  - SpaceNugget 7y ago
    No you are not. the "bug" is that the download page has a link to an http mirror. If there was a bug where the ubuntu website could force your browser to display https:// https:// and serve content over http without a warning you would have most definitely heard about it before now. As to why most mirrors serve over http, it's for the same reasons presented here: https://whydoesaptnotusehttps.com/ https://whydoesaptnotusehttps.com/
    - ben_w 7y ago
      Is there any clear reason why the checksums are also only available on http domains? One of the duplicate bugs: https://bugs.launchpad.net/ubuntu-website-content/+bug/1534967 https://bugs.launchpad.net/ubuntu-website-content/+bug/15349... I believe your link does not explain why Ubuntu’s .iso files are not on https, as one of its justifications is that APT uses other mechanisms for integrity checking, which doesn’t apply to OS installation disk images.
      - dontbenebby 7y ago
        I agree with parent, it doesn't make sense to host checksums on a plain HTTP site. Also grandparent's link states >HTTPS does not provide meaningful privacy for obtaining packages. As an eavesdropper can usually see which hosts you are contacting Which is untrue. An attacker can't tell which specific packages are being downloaded, which could be important depending on your threat model. (The argument can be made size of DL leaks info, but that's a lot of work, and multiple packages could have same size)
scarface74 7y ago
Is providing a pgp signature any safer than having signed apps to ensure that the app both comes from the source you think it comes from and ensuring it hasn’t been tampered with?
dylan604 7y ago
It would be amazing if the desktop OS had a right-click option to validate checksums for you. Just something simple that when clicked allows the user to choose which type of hash to generate, then you still have to compare to the website. In 2019 with the amount of data downloaded, this is something the OS vendors need to do more for their users.
- Nullabillity 7y ago
  Dolphin has this under file properties! That said, it should probably be made far more prominent, and even integrated into web browsers...
  - namibj 7y ago
    It's called metalink. It's great.
- Digit-Al 7y ago
  What you are looking for is HashTab[1]. It adds a tab to your file properties page that shows a variety of different hashes for the file, including MD5, SHA-1, and SHA-256. You can configure it to show a large number of different hashes. Also, if you have copied a hash from a website into your clipboard it will automatically compare it to the configured hashes and show you if there is a match. [1] https://download.cnet.com/HashTab/3000-2094_4-84837.html https://download.cnet.com/HashTab/3000-2094_4-84837.html [edit: typo]
  - dylan604 7y ago
    That sounds cool. However, that's just another piece of software that needs to be downloaded and verified before installing. I want this to be part of the OS. It's a dangerous world out there, and the OS shouldn't make it so hard to stay safe.
    - dontbenebby 7y ago
      Yeah, for example a right click option to show the hash of a file in macOS would be nice. Technically I can do it on the CLI, but most users are cli-shy

ben_w 7y ago

I’ve been around long enough to remember when people thought that sort of thing was a particular flaw of closed-source, but Ubuntu is failing in a similar way, as this unfixed bug from 2014 (confirmed and with multiple duplicates) demonstrates: https://bugs.launchpad.net/ubuntu/+bug/1359836 https://bugs.launchpad.net/ubuntu/+bug/1359836 Call me cynical, but this is what I expect to see if a government had ordered them to allow certain forms of interference with the OS. I don’t know enough to eliminate any other possibility, but it certainly smells fishy.

dontbenebby 7y ago
Wait, am I reading this bug correctly: even if I have HTTPS everywhere installed to force the S in errant urls, it would still go over HTTP? Because... "we provide the signatures"? Yikes.
- SpaceNugget 7y ago
  No you are not. the "bug" is that the download page has a link to an http mirror. If there was a bug where the ubuntu website could force your browser to display https:// https:// and serve content over http without a warning you would have most definitely heard about it before now. As to why most mirrors serve over http, it's for the same reasons presented here: https://whydoesaptnotusehttps.com/ https://whydoesaptnotusehttps.com/
  - ben_w 7y ago
    Is there any clear reason why the checksums are also only available on http domains? One of the duplicate bugs: https://bugs.launchpad.net/ubuntu-website-content/+bug/1534967 https://bugs.launchpad.net/ubuntu-website-content/+bug/15349... I believe your link does not explain why Ubuntu’s .iso files are not on https, as one of its justifications is that APT uses other mechanisms for integrity checking, which doesn’t apply to OS installation disk images.
    - dontbenebby 7y ago
      I agree with parent, it doesn't make sense to host checksums on a plain HTTP site. Also grandparent's link states >HTTPS does not provide meaningful privacy for obtaining packages. As an eavesdropper can usually see which hosts you are contacting Which is untrue. An attacker can't tell which specific packages are being downloaded, which could be important depending on your threat model. (The argument can be made size of DL leaks info, but that's a lot of work, and multiple packages could have same size)

scarface74 7y ago

Is providing a pgp signature any safer than having signed apps to ensure that the app both comes from the source you think it comes from and ensuring it hasn’t been tampered with?

dylan604 7y ago

It would be amazing if the desktop OS had a right-click option to validate checksums for you. Just something simple that when clicked allows the user to choose which type of hash to generate, then you still have to compare to the website. In 2019 with the amount of data downloaded, this is something the OS vendors need to do more for their users.

Nullabillity 7y ago
Dolphin has this under file properties! That said, it should probably be made far more prominent, and even integrated into web browsers...
- namibj 7y ago
  It's called metalink. It's great.
Digit-Al 7y ago
What you are looking for is HashTab[1]. It adds a tab to your file properties page that shows a variety of different hashes for the file, including MD5, SHA-1, and SHA-256. You can configure it to show a large number of different hashes. Also, if you have copied a hash from a website into your clipboard it will automatically compare it to the configured hashes and show you if there is a match. [1] https://download.cnet.com/HashTab/3000-2094_4-84837.html https://download.cnet.com/HashTab/3000-2094_4-84837.html [edit: typo]
- dylan604 7y ago
  That sounds cool. However, that's just another piece of software that needs to be downloaded and verified before installing. I want this to be part of the OS. It's a dangerous world out there, and the OS shouldn't make it so hard to stay safe.
  - dontbenebby 7y ago
    Yeah, for example a right click option to show the hash of a file in macOS would be nice. Technically I can do it on the CLI, but most users are cli-shy