3 ms·
This sort of thing is not as much an issue as you'd think, because at least in Linux world, most automated downloads will compare the SHA256 sum with a referenc
by medstrom 4y ago
This sort of thing is not as much an issue as you'd think, because at least in Linux world, most automated downloads will compare the SHA256 sum with a reference sum retrieved from a HTTPS site (there you go!), if not the GPG signature.
If downloading a file manually, the download pages also tend to recommend you follow provided instructions for doing this yourself.
- tgv 4y agoThe download page randomly picks a mirror, so chances are you get an insecure connection. And the signature won't do much good if it's http or ftp too. For Linux it may work, but for Windows it doesn't.
- medstrom 4y agoThe signature works fine over HTTP/FTP because it needs to be combined with a public key you already have (e.g. a distro package manager will already have the public key for all the packages), or a public key you will go get from a different source, e.g. https://sks-keyservers.net https://sks-keyservers.net, and it's hard for a middle-man to compromise both.