Hacker News Reader

Comment by jedbrown | Hacker News Reader

Note that the SHA256 hashes on the linked website are served over HTTP, which is no security against a MITM. If you use the HTTPS site (https://www.tarsnap.com/spiped.html) then the tarball links are also HTTPS (same security). Why are we asking people to manually verify hashes when the hash and content enjoy the same level of security?

View on HN

Being able to verify the hash of the file can help ensure it didn't get corrupt in transit (rather than maliciously tampered with).

I should have posted the https link. If a mod wants to edit the url for this, twould be appreciated.

cperciva, why serve http at all or not at least redirect people to https by default?

why serve http at all

Any sane packaging system will check hashes against known good values after downloading, so using https just opens up more attack surface.

If they're not using http, where exactly do the known good values come from?

The GPG-signed release announcement.

While valid, this is an extremely user hostile response. Requiring administrators to dig up release notes and hoping they actually have your gpg key and know what to do with it is essentially giving the middle finger to admins that don't understand crypto well.

Not really, because admins that don't bother to read release notes or to verify GPG keys should probably be using package management systems maintained by those who do.

That would be fine if there were never a case where a package management system fell out of date due to a package maintainer not staying on top of things.

How would they get the GPG key securely?

wondering the same thing. cperciva, care to elaborate? if you had https/hsts would the hashes be unnecessary?

The hashes are there for convenience, not for security.

Reply on news.ycombinator.com