Hacker News new | ask | show | jobs
by voltagex_ 4405 days ago
The signatures and binaries are not served over HTTPS. It would be prudent to compare them to other sources.
3 comments
voltagex_ 4405 days ago
Just for reference, SHA1s posted from an independent source yesterday: https://news.ycombinator.com/item?id=7816109
link
dendory 4405 days ago
Actually it would be good if the webmaster behind this reboot got SSL set up. Especially if this is going to be the new most authoritative download source.
link
zurn 4404 days ago
SSL is better than no SSL, but for better assurance they should offline sign the downloads.
link
throwaway7767 4404 days ago
That would be prudent regardless. If you trust HTTPS, why verify the PGP signatures? And if you don't, verifying the PGP signatures does not get you anything if you have no reason to trust the key.
link