3 ms·
The practice of checkums/hashes with files really stems back to FTP and even less reliable transfer mechanisms would randomly corrupt your data. They also let y
by nullc 6y ago
The practice of checkums/hashes with files really stems back to FTP and even less reliable transfer mechanisms would randomly corrupt your data. They also let you use a less trustworthy source, while you get just the hashes from a slow but more trustworthy source.
In Bitcoin's case what is actually provided is a PGP signature. The relevant key isn't provided along with the download files for the reason you mention. Though there are instructions on obtaining and validating the key on the download site. ... and if you're depending on reading those instructions' they're vulnerable to substitution.
- Black101 6y agoFor checking data corruption it makes more sense but most archive formats have this built-in, don't they? I.E.: You won't be able to extract it if it got corrupted.
- nullc 6y agoTar doesn't, nor does the classic unix 'compress' (the thing we all used before gzip). :)
- Black101 6y agoif you are using tar by itself, you are asking for trouble
- r1ch 6y agoDownloading over HTTPS also protects against data corruption in transit.
- vbezhenar 6y agoDownloading over HTTP also protects against data corruption in transit, because HTTP uses TCP and TCP uses CRC32 checksums. Though those checksums are not extremely reliable and have tiny chance of being corrupted.
- nullc 6y ago> TCP uses CRC32 checksums. It uses a 16-bit ones complement addition. At the packet sizes used on the internet it's extremely weak, much more so than you'd expect just from it being 16-bits, especially on data that isn't a uniform binary.