zlacker

>>LorenD+(OP)
The site doesn't have HTTPS and there doesn't seem to be any mention of signatures on the downloads page. Any way to check it hasn't been MITM'd?

>>hypeat+m5
Not foolproof. Could compute MD5 or SHA256 after downloading.

>>firest+Y5
And compare it against what?

EDIT: nevermind, I see that it has the md5 in a text file here: http://www.tinycorelinux.net/16.x/x86/release/

>>hypeat+s7
Which is served from the same insecure domain. If the download is compromised you should assume the hash from here is too.

>>maccar+18
An integrity check is better than nothing, but yes it says nothing about its authenticity.

>>hypeat+n8
An integrity check where both what you're checking and the hash you're checking against is literally not better than nothing if you're trying to prevent downloading compromised software. It'd flag corrupted downloads at least, so that's cool, but for security purposes the hash for a artifact has to be served OOB.

>>embedd+I9
It is better than nothing if you note it down. You can compare it later if somebody / or you was compromised to see whether you had the same download as everyone else.

>>uecker+Ze
Sorry but this is nonsense. It’s better than nothing if you proactively log the hashes before you need them, but it’s actively harmful for anyone wi downloads it after it’s compromised.

>>maccar+4n
"It is better than nothing" is literally what I said. But thinking about it more, I actually think is quite useful. Any kind of signature or out-of-band hash is also only good if the source is not compromised, but knowing after the fact whether you are affected or not is extremely valuable.