Download page @Ubuntu.com

[Matthew Paul Thomas]

On Dec 20, 2006, at 4:51 PM, Matthew Flaschen wrote:
>
> Matthew Nuzum wrote:
>>
>> Yes, note I said that the utility grabbed the md5 from the website. I
>> envisioned that it would make an HTTPS request to download the md5.
>> Either way, this is pure fantasy at the moment.
>
> Yes, but the utility can grab any md5 from any website it wants to, or
> just say it matches without checking anything.  People can't trust the
> file they download to verify itself.
> ...

I think the way the Internet Explorer installer works is that you 
download the installer from downloads.microsoft.com, then the installer 
chooses a mirror based on your location, downloads the actual software, 
and verifies it. That way you can trust the installer, and the 
installer verifies the download.

-- 
Matthew Paul Thomas
http://mpt.net.nz/