The sad state of alarmist posts for karma.
How so?
The author is voicing criticism that a lot of people (including myself) have with regards to the current state of software distribution security.
Furthermore, his survey of the top distributions is interesting for people who take their security seriously.
I remain unconvinced.
Anyone wanting to build on this should apply same methodology to major BSD's to see how they compare.
For example, Arch has HTTP downloads but the download page provides the MD5SUM, SHA1SUM, and PGP signature for verification that the files are correct. I just don't really see this as that big of an issue right now. Even if one has provided instructions for doing so it's still going to require that the end user cares about checking the validity of the files.
One of the points in that and article jacquesm linked is that checksum verification still requires trusting the transport. Otherwise, you get fake binary plus fake checksum that then look safe but were for malicious app. There's just an extra thing to change for attacker. No work at all given what was already put in to get to that point.
So, trustworthy transport of binary and/or checksum is necessary. The checksum should still be there even if binary is sent safely, though, to verify no corruption of binary happened due to transmission or storage faults.
My initial point is that no matter the solutions offered, the user has to care about checking. Forcing HTTPS transport for the download isn't really going to make it any more secure because it's still possible the file is illegitimate and you should be testing the signatures.
tl;dr: Arch's downloads are over HTTP, the checksums and signature are over HTTPS and on the official download page.
https://www.freebsd.org/where.html https://www.freebsd.org/releases/10.3R/signatures.html
Downloads are via FTP by default, but I agree with those that HTTPS cannot be trusted either. Signatures plus building up key trust is the way to go.
Hopefully Keybase.io will make it easier in the future to establish trust in such keys.
I don't know fedora, but when I tried to switch I found the following blocking issue. Fedora has packages missing that you can get in Ubuntu (irc it was vlc for me). There is RPM Fusion but it doesn't have reliable method of verifying repo keys - they send instructions only over http and have only selfsigs on keys. As this has been going on for years and without bothering anyone I can't trust them even if they fix it sometime in the future.