3 ms·

So you refuse to download and install any executable unless it's served over https from one source and matches a checksum listed on a different source? And the

So you refuse to download and install any executable unless it's served over https from one source and matches a checksum listed on a different source? And the argument here is that if you don't do that, you're shit at security?

bildung 7y ago
No, I've said "Same effort, but now attackers would have to have both services compromised to plant a malicious download"