4 ms·
The article does say that you should check the chec— oh, it says "verify the checksum with one you downloaded from a secure place". Oh… oh no. You're right. T
by thomashabets2 11y ago
The article does say that you should check the chec— oh, it says "verify the checksum with one you downloaded from a secure place". Oh… oh no.
You're right.
To the author:
What, pray tell, is this magical secure place that's secure despite not being authenticated or encrypted?
- jessaustin 11y agoThe very next sentence of TFA is, "As there is no need to operate on a partial file there is no technical reason why the entire transfer would have to be SSL encrypted." Clearly, the procedure envisioned is that the checksum is served over TLS.
- Skunkleton 11y agoSo then what? Am I supposed to connect to multiple servers, one for SHAs and the other for blobs? What is the point of that? To be fair, by this point in the article I was just skimming it.
- jessaustin 11y agoChecksums can be simply listed on TLS-enabled websites, or in PGPed emails, or whatever. They don't need to be on CDNs, which in many cases would be indicated for software distribution. The other thing to keep in mind is that a checksum can certify the entire distribution process, from a packager's personal machine all the way to your hard drive. TLS only proves that no one eavesdropped on the connection between your client and whatever machine claims to be the CDN, which for software distribution is pointless and unhelpful.