4

When going to Oracle's download site to download JDK for EE the download is over HTTP (not HTTPS) and the executable isn't signed. As far as I can tell, there are also no SHA1 hashes published so I have no way to verify that the code hasn't been altered.

Does anybody know of a way to verify this or has Oracle not given any way to make sure this is secure?

Improve this question
5
  • Wouldn't setup check for corruption itself before running?
    – AndrejaKo
    Oct 24, 2010 at 15:53
  • Yes but that isn't the question. I want to make sure it hasn't been tampered with (no trojans, viruses, or other malicious code) - in other words that it actually came from Oracle unaltered. That's the point of SHA1 hashes and signed executables.
    – user53352
    Oct 24, 2010 at 16:34
  • Don't you think if the attackers could alter the executables, they would've uploaded the altered hashes ?
    – Sathyajith Bhat ♦
    Oct 24, 2010 at 17:39
  • If they hacked the website yes - if it's a man-in-the-middle no. I'm pretty confident that Oracle and Google's servers are secured but not that every link between my computer and them are (my ISP sometimes redirects me to ad-pages when I browse common sites like hotmail - framing them at the top so I don't trust it!) The country I live in is a large communist dictatorship so it's not impossible that the file could be altered in transit (an SHA1 hash from an SSL page would guarantee that the file the website wanted to send was the one I got).
    – user53352
    Oct 25, 2010 at 0:02
  • Possible duplicate of Is there any way to make sure that downloaded file is from Microsoft?
    – Burgi
    Sep 9, 2018 at 2:33

1 Answer 1

Reset to default
1

Obviously, those md5 things are out of sight of most of big software providers. Youc an go on Oracle, IBM, Microsoft sites, there will be no md5 signatures available. Even for there most expensive products ! I guess they don't really take this risk as seriously as you do.

Anyway, there seems to be a workaround. Olex seems to provide signed downloads for various open-source/freeware products, and the JDK is in the pack !

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .