4 ms·
Well, altered in transit and corrupted in transit are both covered by HTTPS. (I think error detection is even covered in TCP, hence also HTTP?) If a vendor doe
by t0astbread 7y ago
Well, altered in transit and corrupted in transit are both covered by HTTPS. (I think error detection is even covered in TCP, hence also HTTP?)
If a vendor does deliver software over HTTP, then you should verify the script before executing it via a checksum delivered over some secure channel. (This is also what apt, the Debian package manager, does by default afaik.)
- falcolas 7y agoNot just a checksum, a cryptographic signature, which verifies both the contents, and that the contents are from the owner of the key.
- mbreese 7y agoIt's still possible for data to be silently corrupted before it hits the HTTPS server [1]. After dealing with a similar issue that corrupted data silently, but still had valid checksums, I tend to not trust implicit checks. (My example wasn't an HTTPS specific issue, but it in theory could still happen with HTTPS). [1] https://stackoverflow.com/questions/34610581/is-it-necessary-to-verify-checksum-when-data-is-sent-over-https https://stackoverflow.com/questions/34610581/is-it-necessary...