>It's pretty trivial to collide MD5 ... collisions=/=second-preimage attacks >SHA1/2 at least, but preferably a gpg signature would be much better. SHA1/2 isn't any better, you're never going to get hit by file corruption that magically also is a md5 collision.
How do you get hit by file corruption when downloading via TCP in 2016? I don't recall this ever happening to me.
While possible, it's really really unlikely for this to happen without some fairly serious network issues between you and whoever you're downloading from.
I'll just leave this here forums.linuxmint.com pwd /root/hacked_distros/mint/var/www/forums.linuxmint.com forums.linuxmint.com cat config.php Perhaps the insanely secure db credentials had something to do with the breach? But what would I know.
I was waiting for you to show up on this one esp how you called out Linode, etc. I figured you'd point out in detail just how behind the security curve they were. Haha.
I was trying to download Linux securely a month or so ago. It's actually embarrassingly difficult to do. The only two distros that did it right (that I could find) are Debian and Alpine Linux. The rest (including Mint and Ubuntu) had hashes (usually MD5) or GPG keys served over HTTP.
I noticed last year that ubuntu.com - despite being the source from which most people download Ubuntu .isos - has no HTTPS capability and doesn't offer any checksums or gpg signatures on their download page. I believe you can find gpg signatures if you scratch around on their ftp server, but it is ridiculous to assume users will do this (especially when Ubuntu is trying to be a user-friendly distro). Anyway, as a res…
If you are running Ubuntu then you already have signing key (run apt-key list), otherwise you can compare the full fingerprint with the one printed in terminal output in the guide that's hosted on https.
>It's pretty trivial to collide MD5 ... collisions=/=second-preimage attacks >SHA1/2 at least, but preferably a gpg signature would be much better. SHA1/2 isn't any better, you're never going to get hit by file corruption that magically also is a md5 collision.
I think I understand you, but I think you could be a bit more explicit in your assertion. I think you're saying MD5 is still a decent checksum for non-cryptographic purposes. Without a cryptographic signature or other authenticated integrity-checked distribution channel, there's very little advantage of using a cryptographic checksum.
The relevant thing here is that the main weakness in MD5 requires both the "good" and "evil" versions of the message (or file) to be produced by the same party. It doesn't allow J. Random Attacker to swoop in and alter things that already exist. However, it would allow a hypothetical Evil Maintainer to pre-cook "good" and "evil" versions and swap between them without changing the MD5.
How do you get hit by file corruption when downloading via TCP in 2016? I don't recall this ever happening to me.
While possible, it's really really unlikely for this to happen without some fairly serious network issues between you and whoever you're downloading from.
Or a flaky bit in the RAM or (very rarely) storage media.
I noticed last year that ubuntu.com - despite being the source from which most people download Ubuntu .isos - has no HTTPS capability and doesn't offer any checksums or gpg signatures on their download page. I believe you can find gpg signatures if you scratch around on their ftp server, but it is ridiculous to assume users will do this (especially when Ubuntu is trying to be a user-friendly distro). Anyway, as a res…
It's a bit convoluted. Follow this guide - https://help.ubuntu.com/community/VerifyIsoHowto If you are running Ubuntu then you already have signing key (run apt-key list), otherwise you can compare the full fingerprint with the one printed in terminal output in the guide that's hosted on https.
I'll just leave this here forums.linuxmint.com pwd /root/hacked_distros/mint/var/www/forums.linuxmint.com forums.linuxmint.com cat config.php Perhaps the insanely secure db credentials had something to do with the breach? But what would I know.
You have an excellent point, but there's no reason to help attackers by giving them the credentials.
>It's pretty trivial to collide MD5 ... collisions=/=second-preimage attacks >SHA1/2 at least, but preferably a gpg signature would be much better. SHA1/2 isn't any better, you're never going to get hit by file corruption that magically also is a md5 collision.
How do you get hit by file corruption when downloading via TCP in 2016? I don't recall this ever happening to me.
I'll just leave this here forums.linuxmint.com pwd /root/hacked_distros/mint/var/www/forums.linuxmint.com forums.linuxmint.com cat config.php Perhaps the insanely secure db credentials had something to do with the breach? But what would I know.
Might not hurt to post this in the comments section of the Mint blog.
I took the liberty of posting the link to that comment in Linux Mint blog comments. Hopefully they review that soon.