Hacker News Reader

Comment by rakoo | Hacker News Reader

No TLS/SSL ? In the wake of all the security news recently, it's surprising that there is no secured download option.

Plus, no official bittorrent download ? That sucks. If anyone is interested, here's the torrent for the bootonly img. I hope FreeBSD devs these by default in the future.

http://torcache.net/torrent/5f0621060da88eb18c5765c8a2e87e93...

View on HN

I made this account just to reply to this comment. The email about the releases come from the release engineer and are signed. The signed email has the SHA256 of each file. It's just not as apparent when looking at the archived version of email. Also, nearly every subdomain and page on the FreeBSD website cluster has HTTPS available.

I may look like a jerk for complaining, but I'm sad that the default options for downloading FreeBSD are not secure and not technically optimal. (The email are signed with the sha256 sigs, but the archives are not accessible in https _by default), yet I understand they may have other priorities.

Other than that, I applaud FreeBSD's efforts in Libre software at large.

FreeBSD used to release official torrents of ISOs, but the torrent server was taken offline due to a data center migration last year and wasn't ever restored.

I suggested putting magnet links on the download page so they wouldn't need to run a separate server to seed the torrents; as a bonus, they'd be able to use the "web seed" functionality supported by many torrent clients to seed the ISOs from their existing distribution infrastructure.

Discussion on the FreeBSD Forums: http://forums.freebsd.org/viewtopic.php?f=3&t=35711

Why would you need TLS/SSL when you have checksums?

Checksums offer no security. An attacker can alter them right after altering the image. Now if the images were signed, it would be a different story...

Just to follow up on this, what checksums do offer is a way to verify that the file you have locally matches the remote file.

Checksums do not offer this property if both the remote file and checksum are both sent unsecured. If an attacker can MitM the remote file, then they can also do the same for the checksum file.

As long as they send the cryptographic checksum through ssl/tls, you are fine. No need to send the whole file through it.

Unfortunately, ftp.freebsd.org doesn't seem to support https.

Checksums are also found in the PGP signed release email.

Here's the announcement posted to freebsd-stable, which does include the checksums:

http://lists.freebsd.org/pipermail/freebsd-stable/2013-Decem...

In addition, that list is mirrored in several other locations so you can verify it independently from across the Internet.

Personally, I feel that this is better than simply posting the checksums in the same directory as the ISO images. I do wish the announcement e-mail was GPG signed, though.

Reply on news.ycombinator.com