| ▲ | hypeatei 6 hours ago |
| The site doesn't have HTTPS and there doesn't seem to be any mention of signatures on the downloads page. Any way to check it hasn't been MITM'd? |
|
| ▲ | Y_Y 6 hours ago | parent | next [-] |
| https://github.com/tinycorelinux |
|
| ▲ | lysace 6 hours ago | parent | prev | next [-] |
| Ideas to decrease risk of MITM: Download from at least one more location (like some AWS/GCP instance) and checksum. Download from the Internet Archive and checksum: https://web.archive.org/web/20250000000000*/http://www.tinyc... |
|
| ▲ | firesteelrain 6 hours ago | parent | prev | next [-] |
| Not foolproof. Could compute MD5 or SHA256 after downloading. |
| |
| ▲ | hypeatei 6 hours ago | parent [-] | | And compare it against what? EDIT: nevermind, I see that it has the md5 in a text file here: http://www.tinycorelinux.net/16.x/x86/release/ | | |
| ▲ | maccard 6 hours ago | parent [-] | | Which is served from the same insecure domain. If the download is compromised you should assume the hash from here is too. | | |
| ▲ | hypeatei 6 hours ago | parent | next [-] | | An integrity check is better than nothing, but yes it says nothing about its authenticity. | | |
| ▲ | firesteelrain 6 hours ago | parent | next [-] | | You can use this site https://distro.ibiblio.org/tinycorelinux/downloads.html And all the files are here https://distro.ibiblio.org/tinycorelinux/16.x/x86/release/ Under a HTTPS connection. I am not at a terminal to check the cert with OpenSSL. I don’t see any way to check the hash OOB Also this same thing came up a few years ago https://www.linuxquestions.org/questions/linux-newbie-8/reli... | | |
| ▲ | maccard 5 hours ago | parent [-] | | Is that actually tiny core? It’s _likely_ it is, but that’s not good enough. > this same thing came up a few years ago Honestly, that makes this inexcusable. There are numerous SSL providers available for free, and if that’s antithetical to them, they can use a self signed certificate and provide an alternative method of verification (e.g. via mailing list). The fact they don’t take this seriously means there is 0 chance I would install it! Honestly, this is a great use for a blockchain… | | |
| ▲ | firesteelrain 5 hours ago | parent [-] | | I usually only install on like a Raspberry Pi or VM for these toy distros Are any distros using block chain for this ? I am used to using code signing with HSMs | | |
| ▲ | maccard 3 hours ago | parent [-] | | I’d install it as a VM maybe, > are any sisters using blockchain I don’t think so, but it’s always struck me as a good idea - it’s actual decentralised verification of a value that can be confirmed by multiple people independently without trusting anyone other than the signing key is secure. > I am used to code signing with HSMs Me too, but that requires distributing the public key securely which… is exactly where we started this! |
|
|
| |
| ▲ | embedding-shape 6 hours ago | parent | prev | next [-] | | An integrity check where both what you're checking and the hash you're checking against is literally not better than nothing if you're trying to prevent downloading compromised software. It'd flag corrupted downloads at least, so that's cool, but for security purposes the hash for a artifact has to be served OOB. | | |
| ▲ | uecker 5 hours ago | parent [-] | | It is better than nothing if you note it down. You can compare it later if somebody / or you was compromised to see whether you had the same download as everyone else. | | |
| ▲ | maccard 4 hours ago | parent [-] | | Sorry but this is nonsense. It’s better than nothing if you proactively log the hashes before you need them, but it’s actively harmful for anyone wi downloads it after it’s compromised. | | |
| ▲ | uecker 2 hours ago | parent [-] | | "It is better than nothing" is literally what I said. But thinking about it more, I actually think is quite useful. Any kind of signature or out-of-band hash is also only good if the source is not compromised, but knowing after the fact whether you are affected or not is extremely valuable. |
|
|
| |
| ▲ | maccard 5 hours ago | parent | prev [-] | | It’s not better than nothing - it’s arguably worse. |
| |
| ▲ | firesteelrain 5 hours ago | parent | prev [-] | | There is a secure domain to download from as a mirror. For extra high security, the hash should be delivered OOB like on a mailing list but it isn’t | | |
| ▲ | maccard 3 hours ago | parent [-] | | Where is that mirror linked from? If for the HTTP site that’s no better than downloading it from the website in the first place. > for extra high security, No, sending the hash on a mailing list and delivering downloads over https is the _bare minimum_ of security in this day and age. |
|
|
|
|
|
| ▲ | throwaway984393 5 hours ago | parent | prev [-] |
| Because there's big demand to mitm users of an extremely small and limited distribution from 2008? |
