3 ms·

Let's say he instead did a traditional installer link. Would it be any different for most users? Nobody actually checks the checksum.

• MBCook 5y ago
  Somehow that feels way safer. I guess it’s not, but it feels like it is.
  • gjsman-1000 5y ago
    Yeah - except if you owned the domain, you can also change the posted hash you are comparing against. Security theater mostly.
    • open1414 5y ago
      It's mostly for applications which hosts their binaries on third party servers
    • MaxLeiter 5y ago
      Or he posts the hash on another service
    • celdon25 5y ago
      That's why you validate it against wayback machine, mailing list archives, multiple devices, and so on.
• glandium 5y ago
  A traditional installer for mac would be signed, though. Which only really means someone paid $99 to Apple.
• celdon25 5y ago
  > Nobody actually checks the checksum. This is incorrect. For hardened installations, it is an absolute must. That being said, I don't see that as being reasonable to expect for this alpha distro.