"malicious CDN couldn't make an evil file" Then the CDN, by definition, would control the data that the end-user (downloader) hashes. But I understand the con

"malicious CDN couldn't make an evil file" Then the CDN, by definition, would control the data that the end-user (downloader) hashes. But I understand the confusion: londons_explore meant to write "there are no known (practical) preimage attacks" against MD5, which is true, since the only theoretical preimage has a complexity 2^123 or so.