3 ms·
Note that the SHA256 hashes on the linked website are served over HTTP, which is no security against a MITM. If you use the HTTPS site (https://www.tarsnap.com
by jedbrown 13y ago
Note that the SHA256 hashes on the linked website are served over HTTP, which is no security against a MITM. If you use the HTTPS site (https://www.tarsnap.com/spiped.html https://www.tarsnap.com/spiped.html) then the tarball links are also HTTPS (same security). Why are we asking people to manually verify hashes when the hash and content enjoy the same level of security?
- mtoledo 13y agowondering the same thing. cperciva, care to elaborate? if you had https/hsts would the hashes be unnecessary?
- cperciva 13y agoThe hashes are there for convenience, not for security.
- malandrew 13y agoI should have posted the https link. If a mod wants to edit the url for this, twould be appreciated. cperciva, why serve http at all or not at least redirect people to https by default?
- cperciva 13y agowhy serve http at all Any sane packaging system will check hashes against known good values after downloading, so using https just opens up more attack surface.
- hueving 13y agoIf they're not using http, where exactly do the known good values come from?
- cperciva 13y agoThe GPG-signed release announcement.
- hueving 13y agoWhile valid, this is an extremely user hostile response. Requiring administrators to dig up release notes and hoping they actually have your gpg key and know what to do with it is essentially giving the middle finger to admins that don't understand crypto well.
- jasomill 13y agoNot really, because admins that don't bother to read release notes or to verify GPG keys should probably be using package management systems maintained by those who do.
- hueving 13y agoThat would be fine if there were never a case where a package management system fell out of date due to a package maintainer not staying on top of things.
- junglhilt 13y agoHow would they get the GPG key securely?
- JosephRedfern 13y agoBeing able to verify the hash of the file can help ensure it didn't get corrupt in transit (rather than maliciously tampered with).