How to take over the computer of a Maven Central user

Re:How to take over the computer of a Maven Central user by yourad_io on Monday July 28, 2014 @11:07PM (#8100517)

From the article:

> When JARs are downloaded from Maven Central, they go over HTTP, so a man in the middle proxy can replace them at will. It’s possible to sign jars, but in my experimentation with standard tools, these signatures aren’t checked. The only other verification is a SHA1 sum, which is also sent over HTTP.

[ Parent | on HN ]

Re:How to take over the computer of a Maven Central user by shortstuffsushi on Tuesday July 29, 2014 @12:37AM (#8100700)

I agree that they aren't checked by default, you'd need to implement it (as the parent commenter seemed to be doing with their gradle plugin). Regarding the sums being sent over HTTP as well, seems that you'll need a checksum for your checksum. Ultimately, though, it just seems that it'd be best to avoid this while it's over HTTP.

[ Parent | on HN ]