4 ms·
Tangential security nitpick - doesn't it defeat the purpose to display SHA or MD5 sums for downloads over a non-ssl page? A bad actor could easily modify these
by atonse 13y ago
Tangential security nitpick - doesn't it defeat the purpose to display SHA or MD5 sums for downloads over a non-ssl page?
A bad actor could easily modify these in a proxy etc when serving the page.
Edit: Unless the purpose isn't to prevent tampering, but for error-correction.
- stronglikedan 13y agoAn attacker would have to modify the actual gem files in a way that would yield the same checksums, since the hashing is one way only.
- rst 13y agoThe attack scenario is that the man-in-the-middle alters the checksums in the page to match the checksums of his backdoored version.