2 ms·

#2 is speculation. Seems possible that there's an unrelated bug causing checksum errors. In any event, it's not a good look right now.

• wyldfire 6y ago
  Regardless of the motivation, cause, mechanism of #2 - #3 is not the appropriate way to handle the problem. Attack is indistinguishable from unintentional corruption. And #3 trains customers to do the wrong thing when they encounter an attack.
  • eli 6y ago
    The malicious file was signed with the right certificate. So yeah you should ideally be more careful with checksums but there already was a much more robust and secure authentication mechanism and it was defeated.
    • heleninboodler 6y ago
      Yes, these are two orthogonal egregious security problems.