Hacker News Reader

Comment by ams6110 | Hacker News Reader

I've used handbrake some time ago but not recently, and hadn't heard about this. Summmary of the situation from the handbrake website:

HandBrake-1.0.7.dmg was replaced by another unknown malicious file that DOES NOT match the SHA1 / SHA256 hashes on our website or on our Github Wiki which mirrors these: https://github.com/HandBrake/HandBrake/wiki/Checksums

The Affected Download mirror (download.handbrake.fr) has been shutdown for investigation.

The Primary Download Mirror and website were unaffected.

Downloads via the applications built-in updater with 1.0 and later are unaffected. These are verified by a DSA Signature and will not install if they don't pass.

Downloads via the applications built-in updater with 0.10.5 and earlier did not have verification so you should check your system with these older releases

View on HN

It's a shame that it isnt easier to check for the correct hash on downloaded software. I know it's a one liner in the terminal, but that scares prople.

In KDE / Dolphin you can right click on a file, select 'properties' and then there is a tab for different checksums.

We need a right click > verify, then user pastes in the hash. It could also be added to the browser.

A hash property on the <a> tag would be spiffy

Apparently there is, sorta: https://news.ycombinator.com/item?id=14335840

This is a HTML feature now, it's called sub-resource integrity. So you just put the hash inside a new element called "integrity" when you refer to external resources. Like so: <a href="..." integrity="...">

Correcting myself: looks like the SRI spec hasn't included the <a> element in the list of supported elements, though it has a mention that it might be supported in a future version :(

How does the browser know what hash algo to use?

https://hacks.mozilla.org/2015/09/subresource-integrity-in-f...

"As you may have noticed, the integrity attribute does not just include the hash value. It also contains the digest name. The syntax for the integrity attribute allows multiple tokens of this name-value format. This allows site owners to specify hashes of different strengths as well as the values of multiple scripts that may be behind a URL. This is useful for browser sniffing or content negotiation."

Browsers could show a checksum when hovering on a downloaded file.

This is a brilliant idea! Does Firefox accept feature proposals if they're fleshed out? My friend is an aspiring UX designer looking to build a portfolio, and I can write crude sample code.

Not so sure that's a good idea. This would prevent users to programmatically compare hashes, and it would be hard to display one next to the other to facilitate comparison. Keep in mind that it is relatively easy to create a file that matches the first and/or last N chars of a hash. And who checks the center of the hash? No, we have to have the browser compare the full hash and give a simple green light to the user. I don't have a proposition in terms of UX but it should be studied (should have been 15 years ago actually)

I was thinking the same thing, actually. I made a UX mockup this morning that I feel good about and was able to explain to my parents over brunch. I'll see if my friend wants to work on it.

Reply on news.ycombinator.com