Re: [opensuse] unique checksum? [Was: best file distribution technology for my case?]

Michael Skiba wrote:
...sure it'll be possible to have two files with the same,
the point is, that it is almost impossible to make use of it to attack
something, since the file with the same md5sum must be valid and
contains the
destructive code and this will be rather difficult.

Right. On the other hand, if someone has access to the web server to
plant their malicious files, they also have access to the files that
hold the checksums. So in practice checksums are good protection
against files corrupted in transit, but rather weak protection against
malicious modifications. To check for that, you'd use PGP and get the
public key from a keyserver or some other source, *not* from the
webserver you downloaded the file from.

--
To unsubscribe, e-mail: opensuse+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse+help@xxxxxxxxxxxx