> Checksums can be verified after download
They can be but _are_ they? Does their installer actually verify the checksum?
Because if it's designed for systems so minimal/broken they can't do normal HTTPS, I kinda doubt it...
They can be but _are_ they? Does their installer actually verify the checksum?
Because if it's designed for systems so minimal/broken they can't do normal HTTPS, I kinda doubt it...
Therefore, it's trivially possible to RCE someone running this script you are MITMing - block all the HTTPS connections, and then replace the binary in the HTTP connection with malware.
Frankly this vulnerability is so obvious and so negligent that I would never use this tool, which is unfortunate as it sounds like a cool idea.
This is the DEFAULT fallback behavior in their installer - not something that only happens on legacy machines.
If I install a project from GitHub on the airport WiFi I'm assuming that the authors know what they're doing and I'm not potentially getting silently MITMed. And when I find out the authors don't know what they're doing to this extreme extent, I note down to never use their project.