Hacker News Reader

A traditional installer for mac would be signed, though. Which only really means someone paid $99 to Apple.

> Nobody actually checks the checksum.

This is incorrect. For hardened installations, it is an absolute must.

That being said, I don't see that as being reasonable to expect for this alpha distro.

Somehow that feels way safer.

I guess it’s not, but it feels like it is.

Yeah - except if you owned the domain, you can also change the posted hash you are comparing against. Security theater mostly.

It's mostly for applications which hosts their binaries on third party servers

Or he posts the hash on another service

That's why you validate it against wayback machine, mailing list archives, multiple devices, and so on.