Download page @Ubuntu.com

[Matthew Flaschen]

Matthew Nuzum wrote:
> Yes, note I said that the utility grabbed the md5 from the website. I
> envisioned that it would make an HTTPS request to download the md5.
> Either way, this is pure fantasy at the moment.

Yes, but the utility can grab any md5 from any website it wants to, or
just say it matches without checking anything.  People can't trust the
file they download to verify itself.

Matthew Flaschen

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 252 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-doc/attachments/20061219/1378711b/attachment.pgp>