Re: [OT] Signed download from sourceforge

[Camaleón <noelamac@gmail.com>]

On Thu, 15 Sep 2011 20:01:08 -0400, Dan wrote:

> I was wondering how to download a binary in a secured way from
> sourceforge.

Uh? :-?

> With debian it is very straightforward, you download it, check the
> md5sum or sha1 and then check the signature.
> 
> In sourceforge I see that you can find the md5 and the sha1 but they are
> both transmited with http and not with https. So, How can I trust the
> source? Do I miss something? Someone can hack the router (for example)

Mmm... "https://"; does not add any extra security layer that solves your 
concern, I mean, with sha1 or md5sum you can ensure the file you download 
is the same as it is in the server and has not beed changed not corrupted.

But now think about it... how do you know the file you are going to 
download is good? Even it is signed it can contain "bad" code >;-)

In brief, adding a secure channel here (like https) does not make sense 
as you are not transferring sensitive information, it's all public :-)

Greetings,

-- 
Camaleón