3 ms·
Regarding "All software downloads should be provided only over HTTPS", this is very expensive to provide, but is allowing users to compare a checksum an equally
by marquis 15y ago
Regarding "All software downloads should be provided only over HTTPS", this is very expensive to provide, but is allowing users to compare a checksum an equally secure option?
- jpiasetz 15y agoWhat's to stop someone in the middle changing the checksum on the page?
- fuzzmeister 15y agoThe download page could still be served via HTTPS, even if the download itself isn't.
- nodata 15y agoThe checksum is normally gpg signed.
- MikeCapone 15y agoBy expensive you mean in CPU cycles, right? Isn't it becoming less expensive all the time thanks to Moore's Law? Is it really all that expensive these days? (I'm really asking because I don't know, this isn't rethorical.)
- marquis 15y agoYes, CPU cycles is the most expensive. Great discussion here on Stackoverflow: http://stackoverflow.com/questions/149274/http-vs-https-performance http://stackoverflow.com/questions/149274/http-vs-https-perf...
- alexchamberlain 15y agoCould this be mitigated by using some form of hardware accelration on servers?