0

Like when you download node.js there is a long list of shasums for each download, windows, osx, linux.

http://blog.nodejs.org/

Why is that?

I know you can check a file sha1sum and thereby check if the file is exactly like the developers wanted it to be, but who does that? Is that the reason?

I have never tried downloading a file and it was corrupt or something.

Improve this question

2 Answers 2

Reset to default
2

Reason 1

Allows you to check if the file wasn't corrupted during download.

Reason 2

Allows you to check if the file wasn't tampered with by a third party.

Improve this answer
3
  • Okay, but the change of the file is tampered when you download it directly from the original site, isn't that pretty small? So why do the work of posting the shasums?
    – Kevin Simper
    Apr 16, 2013 at 9:36
  • 2
    @KevinSimper: The host the file is served from may be a different host than the one that holds the SHA sum. Someone might have broken into the file host. And, thinking that something is very unlikely to be tampered with, is exactly the kind of thinking that gets you into trouble ;)
    – Oliver Salzburg
    Apr 16, 2013 at 9:45
  • 1
    Of course, if the HTML showing the expected SHA sum and the file to be served reside on the same server, it may well be that the attacker also modified the HTML pages to give the SHA sums of the modified file.
    – Frerich Raabe
    Apr 4, 2015 at 8:15
1

I know you can check a file sha1sum and thereby check if the file is exactly like the developers wanted it to be, but who does that? Is that the reason? I have never tried downloading a file and it was corrupt or something.

Just because it has never happened to you doesn't mean it can't happen, and you wouldn't want it to happen if you're putting the file up on an extremely busy production server. Corruptions can occur anywhere in the transfer chain, and it's enough that one piece of hardware in the line has a malfunction.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .