3 ms·
1. Don't install software from untrusted sources. 2. The trusted sources should provide checksums so you can verify the package before installing it. This prot
by Arnor 13y ago
1. Don't install software from untrusted sources.
2. The trusted sources should provide checksums so you can verify the package before installing it.
This protects you from a compromised package so long as the page you accessed the package from has not been compromised (if that page is compromised, the checksum could be changed to the new one).
I have no idea how you would verify closed source software if the checksum and package are both corrupted...
- donutz 13y ago"2. The trusted sources should provide checksums so you can verify the package before installing it." If the checksum is published to another trusted location, in addition to where you download the files, that would help in the case that an attacker compromises both the checksum and the package on the download site. The developer could post the checksum to Twitter at the same time as making the package available for download. An attacker would need to compromise both Twitter and the download site.