Hacker News Reader

What others said. Checksums downloaded via HTTP are just as easy to spoof as the tarball. The VPN protects you part of the way but not the entire way. Now, if you said that I could verify the download because it was signed using the publisher's GPG key and that key was widely trusted, then I might have entertained the idea. Then again, that is very non-standard compared to getting a $10 TLS cert.

> why not always use a VPN?

Because then you're susceptible to remote MITM? VPNs are useful but do not replace end-to-end encryption.

That's why I qualified it with local. Have anything to say about checksums too?

A checksum that's published via HTTP doesn't protect you against MITM.

You know this links is also not served on HTTPS. So local MITM can change the checksum on this page too.