3 ms·
The problem is, the wrong party is doing the check (from a security point of view, not integrity). When we download a script from a remote domain we don't trus
by kazinator 3y ago
The problem is, the wrong party is doing the check (from a security point of view, not integrity).
When we download a script from a remote domain we don't trust, we have to validate its checksum against the known one; we can't leave that to the script, which we don't trust.
- kevincox 3y ago99% of the time you are downloading from a domain that you do trust. This check is to detect corruption, not malice. But yes, if you were downloading from an untrusted mirror you would want to check the signature or trusted hash before running the script at all.
- joshspankit 3y agoIn this case we’re specifically talking about the possibility of a truncated script from a trusted source