Hacker News Reader

Comment by nerdponx | Hacker News Reader

It's a shame that it isnt easier to check for the correct hash on downloaded software. I know it's a one liner in the terminal, but that scares prople.

View on HN

In KDE / Dolphin you can right click on a file, select 'properties' and then there is a tab for different checksums.

We need a right click > verify, then user pastes in the hash. It could also be added to the browser.

A hash property on the <a> tag would be spiffy

Apparently there is, sorta: https://news.ycombinator.com/item?id=14335840

This is a HTML feature now, it's called sub-resource integrity. So you just put the hash inside a new element called "integrity" when you refer to external resources. Like so: <a href="..." integrity="...">

How does the browser know what hash algo to use?

https://hacks.mozilla.org/2015/09/subresource-integrity-in-f...

"As you may have noticed, the integrity attribute does not just include the hash value. It also contains the digest name. The syntax for the integrity attribute allows multiple tokens of this name-value format. This allows site owners to specify hashes of different strengths as well as the values of multiple scripts that may be behind a URL. This is useful for browser sniffing or content negotiation."

Correcting myself: looks like the SRI spec hasn't included the <a> element in the list of supported elements, though it has a mention that it might be supported in a future version :(

Browsers could show a checksum when hovering on a downloaded file.

This is a brilliant idea! Does Firefox accept feature proposals if they're fleshed out? My friend is an aspiring UX designer looking to build a portfolio, and I can write crude sample code.

Not so sure that's a good idea. This would prevent users to programmatically compare hashes, and it would be hard to display one next to the other to facilitate comparison. Keep in mind that it is relatively easy to create a file that matches the first and/or last N chars of a hash. And who checks the center of the hash? No, we have to have the browser compare the full hash and give a simple green light to the user. I don't have a proposition in terms of UX but it should be studied (should have been 15 years ago actually)

I was thinking the same thing, actually. I made a UX mockup this morning that I feel good about and was able to explain to my parents over brunch. I'll see if my friend wants to work on it.

Reply on news.ycombinator.com