3 ms·

Actually if you just google the MD5 and it shows up in google should work as a guarantee (Example: https://www.google.com/search?q=b13afc01102c84425ca995469f1a

• pferde 13y ago
  Unless the malware is spread by Google.
  • rst 13y ago
    ... or, more likely, the MITM is capable of spoofing selected google searches as well.
    • ivanca 13y ago
      You know Google always uses ssl right?
      • rst 13y ago
        There are people in the world capable of spoofing SSL one way or another (forged certs, suborned CAs, etc.), though it certainly does raise the bar past the script kiddie level.
• erichurkman 13y ago
  Unless the download page is hacked and Google picks up a spoofed checksum. They need to sign their updates as well.
  • ivanca 13y ago
    Yeah, and Linux is compromised if someone kidnaps Linus Torvalds family in exchange for creating a backdoor in the Linux kernel. The security is created by humans to be used by humans; so nothing is truly safe if <insert random circumstance> happens; and anyway, for cases like yours the hack would be found after few days when any of the people in charge of the compiling realizes that the check-sum is spoofed and would advice anyone to update the OS after the issues is taken care of.