Hacker News Reader

>Installing random binaries used to be a bad thing, now it's outright encouraged. "Thanks for using our toilet. Download our app to unlock the door!"

It's surprising to me how rarely even reputable companies provide hashes/signatures.

I just downloaded a Windows virtual machine that MS offers for free[1].

No sha256 sum, no pgp signature. I ended up deciding that since it it served over HTTPS from an MS controlled domain that I'd accept the risk, but I wish more vendors would allow advanced users to verify downloads.

(MS is not alone in this, many, many open source projects offer up pre-compiled binaries with zero checksum info, which especially sucks since so often they rely on an assortment of mirrors for the binaries rather than a central location)

I understand that telling users to fire up the CLI may be a pain point, but offering the information as an optional step for the experienced user should be a best practice IMHO.

[1]For the interested, seems to last "only" 30 days but you can roll back to a snapshot if you're just testing compatibility of sites with Edge: https://developer.microsoft.com/en-us/microsoft-edge/tools/v...

It would be amazing if the desktop OS had a right-click option to validate checksums for you. Just something simple that when clicked allows the user to choose which type of hash to generate, then you still have to compare to the website. In 2019 with the amount of data downloaded, this is something the OS vendors need to do more for their users.

What you are looking for is HashTab[1]. It adds a tab to your file properties page that shows a variety of different hashes for the file, including MD5, SHA-1, and SHA-256. You can configure it to show a large number of different hashes. Also, if you have copied a hash from a website into your clipboard it will automatically compare it to the configured hashes and show you if there is a match.

[1] https://download.cnet.com/HashTab/3000-2094_4-84837.html

[edit: typo]

That sounds cool. However, that's just another piece of software that needs to be downloaded and verified before installing. I want this to be part of the OS. It's a dangerous world out there, and the OS shouldn't make it so hard to stay safe.

Yeah, for example a right click option to show the hash of a file in macOS would be nice. Technically I can do it on the CLI, but most users are cli-shy

Dolphin has this under file properties! That said, it should probably be made far more prominent, and even integrated into web browsers...

It's called metalink. It's great.

Is providing a pgp signature any safer than having signed apps to ensure that the app both comes from the source you think it comes from and ensuring it hasn’t been tampered with?

I’ve been around long enough to remember when people thought that sort of thing was a particular flaw of closed-source, but Ubuntu is failing in a similar way, as this unfixed bug from 2014 (confirmed and with multiple duplicates) demonstrates: https://bugs.launchpad.net/ubuntu/+bug/1359836

Call me cynical, but this is what I expect to see if a government had ordered them to allow certain forms of interference with the OS. I don’t know enough to eliminate any other possibility, but it certainly smells fishy.

Wait, am I reading this bug correctly: even if I have HTTPS everywhere installed to force the S in errant urls, it would still go over HTTP? Because... "we provide the signatures"? Yikes.

No you are not. the "bug" is that the download page has a link to an http mirror.

If there was a bug where the ubuntu website could force your browser to display https:// and serve content over http without a warning you would have most definitely heard about it before now.

As to why most mirrors serve over http, it's for the same reasons presented here: https://whydoesaptnotusehttps.com/

Is there any clear reason why the checksums are also only available on http domains? One of the duplicate bugs: https://bugs.launchpad.net/ubuntu-website-content/+bug/15349...

I believe your link does not explain why Ubuntu’s .iso files are not on https, as one of its justifications is that APT uses other mechanisms for integrity checking, which doesn’t apply to OS installation disk images.

I agree with parent, it doesn't make sense to host checksums on a plain HTTP site.

Also grandparent's link states

>HTTPS does not provide meaningful privacy for obtaining packages. As an eavesdropper can usually see which hosts you are contacting

Which is untrue. An attacker can't tell which specific packages are being downloaded, which could be important depending on your threat model.

(The argument can be made size of DL leaks info, but that's a lot of work, and multiple packages could have same size)

Interesting; the first two points you make sound wrong. It used to be that you got most software via "random binaries"; then, in the late 2000s, it became out of fashion and attention was called to dangers. It used to be, when Internet was new, that people didn't have trouble publishing personal information. Personal SEO was a thing; people optimized what prospective employers would find when googling their surname. Facebook came later, and even later still we got calls to stop publishing personal information.

> Devices are now shipping with easy-to-enable "anonymous mode" apps that average users have no legitimate need for...

I'd argue VPNs are increasingly tablestakes as consumer ISPs adopt darker patterns like tag injection. (Recently discovered this in the wild with my new residential ISP.)

> infosec

It isn't the rise of fascism -- it's the rise of hyper-profiteering. There is too much money to be made from the ignorance of well-conditioned consumers for principle to prevail.

Reminds me of that one time when Microsoft in late 90s sent one web request back to Redmond for Windows installations and all hell broke loose! Microsoft is tracking/controlling everyone and could update things centrally - total world domination is the goal!

Then came Google and everyone just surrendered their stuff voluntarily anyway.

I think sometimes the player just changes, and then users and media accepts the new reality.

Used to be, don't publish information about yourself that could be used to impersonate you. Then we got Facebook.

With the number of data breaches by credit reporting agencies, Facebook is the least of your worries.

Installing random binaries used to be a bad thing, now it's outright encouraged. "Thanks for using our toilet. Download our app to unlock the door!"

With iOS, the amount of damage an untrusted binary can do is extremely limited.

Opt-in billing used to be the domain of sleazy porn sites, but now you can't buy anything from Amazon without them trying to surreptitiously slip a Prime subscription into your cart during checkout.

Sleazy billing has been a thing since Columbia House.