3 ms·

In the good old days you could check the MD5 checksums of mostly everything you downloaded. But then you had to trust the website that published the checksums

• fritzo 3y ago
  And then sourceforge was taken over by malware injectors...
• pants2 3y ago
  On the flip side, you would hope that the malicious binaries in these packages have already been flagged by antivirus providers.
• Too 3y ago
  That says absolutely nothing if the page serving the expected md5 sum is also compromised. With HTTPS, everything is already checked in transit, so you don’t need to verify it again. On top of that, with git, all the revisions are inherently verified as sha1 hashes. In either case, what’s inside may still be malicious if you end up on a typosquatted repo.