News for hackers. Stuff that matters.

A comment on Ask HN: Anonymous person sent proof of SSH access to our production server. Parent comment

Re:Ask HN: Anonymous person sent proof of SSH access to our ... by robocat on Wednesday July 27, 2016 @05:35PM (#12176689)
To be fair, some major Linux distros also distribute using http e.g. go to https://www.debian.org/ and check the Download link at the top of the page: it is http.
[ Parent | on HN ]
Re:Ask HN: Anonymous person sent proof of SSH access to our ... by dozzie on Thursday July 28, 2016 @03:35AM (#12178883)
Yes, but there are some important differences:

- Debian provides SHA-512 checksums of those ISO images

- the checksums are signed cryptographically

- web server is not the only distribution point

- Debian packages are distributed signed, so once you have your OS installer somehow verified, you're much safer than with Homebrew

Granted, SHA-512 checksums and their GPG signatures are not exposed very prominently on Debian's homepage. You need to go to the listing of directory with ISO instead of clicking "download ISO" direct link.

[ Parent | on HN ]