Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When going to Oracle's download site (https://cds.sun.com/is-bin/INTERSHOP.enfinity/WFS/CDS-CDS_SMI-Site/en_US/-/USD/ViewProductDetail-Start?ProductRef=java_ee_sdk-6u1u21-wjdk-oth-JPR@CDS-CDS_SMI) to download JDK for EE the download is over HTTP (not HTTPS) and the executable isn't signed. As far as I can tell, there are also no SHA1 hashes published so I have no way to verify that the code hasn't been altered.

Does anybody know of a way to verify this or has Oracle not given any way to make sure this is secure?

share|improve this question
    
Wouldn't setup check for corruption itself before running? –  AndrejaKo Oct 24 '10 at 15:53
    
Yes but that isn't the question. I want to make sure it hasn't been tampered with (no trojans, viruses, or other malicious code) - in other words that it actually came from Oracle unaltered. That's the point of SHA1 hashes and signed executables. –  user53352 Oct 24 '10 at 16:34
    
Don't you think if the attackers could alter the executables, they would've uploaded the altered hashes ? –  Sathya Oct 24 '10 at 17:39
    
If they hacked the website yes - if it's a man-in-the-middle no. I'm pretty confident that Oracle and Google's servers are secured but not that every link between my computer and them are (my ISP sometimes redirects me to ad-pages when I browse common sites like hotmail - framing them at the top so I don't trust it!) The country I live in is a large communist dictatorship so it's not impossible that the file could be altered in transit (an SHA1 hash from an SSL page would guarantee that the file the website wanted to send was the one I got). –  user53352 Oct 25 '10 at 0:02

1 Answer 1

Obviously, those md5 things are out of sight of most of big software providers. Youc an go on Oracle, IBM, Microsoft sites, there will be no md5 signatures available. Even for there most expensive products ! I guess they don't really take this risk as seriously as you do.

Anyway, there seems to be a workaround. Olex seems to provide signed downloads for various open-source/freeware products, and the JDK is in the pack !

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.