4 ms·
What assurances does that give you beyond the https certificate on their official website which contains the binary downloads and hashes?
by shawabawa3 7y ago
What assurances does that give you beyond the https certificate on their official website which contains the binary downloads and hashes?
- Groxx 7y agoDefense in depth, essentially. But yes, checking site X to see if site X gave you Y correctly is rather weak confidence. To argue in its favor tho, file-hosting and site-serving may be handled by different systems with different security characteristics, and potentially even different datacenters (e.g. a CDN). If you only have to compromise one system, it's generally easier to do so than when you have to compromise N and make them all agree with each other.
- Thaxll 7y agoThe hash and file are not hosted on the same place so it's good enough.
- mfer 7y agoIf a hosting server is compromised the hash and download can be changed with something nefarious. crypto signing/verification will catch that case. hash checking will not. This is a legitimate case as it's happened to other projects in the past.
- groobongithub 7y agoThe download comes from dl.google.com while the checksum is published on golang.org. FWIW the macOS pkg you download is signed.