Tag Info

Hot answers tagged

83

I have heard this is to allow [...] for any malicious changes to be detected also. Well you heard wrong, then. MD5 (or SHA or whatever) checksums are provided (next to downloads links, specifically) only for verifying a correct download. The only thing they aim to guarantee is that you have the same file as the server. Nothing more, nothing less. If the ...


71

I take it you're referring to windows programs? I circumvented the whole problem by using Linux Mint (and even keeping installed packages to a minimum with --no-install-recommends & a similar option in Synaptic/apt.conf). It's got Firefox, Chromium, Opera, LibreOffice, Flash Player, GIMP, tons of excellent "evilware-free" software. But if your ...


62

In addition to what has been suggested, you'll find that by preferring open source software to closed source will generally take care of this problem for you. Instead of CNET, look on Sourceforge and GitHub and you'll find much better software. Update Many have also mentioned Chocolatey. It is definitely a big piece of the full puzzle. In general, command ...


18

I would recommend using Chocolatey. I've not seen any bloatware in the installers used there as they are sometimes repackaged by package maintainers. Chocolatey is a package manager for Windows (like apt-get or yum but for Windows). It was designed to be a decentralized framework for quickly installing applications and tools that you need. It is built ...


15

For sourceforge in particular, append ?nowrap to the URL - this will allow you to download the file without the sourceforge "wrapper" that adds crapware to the installer - for example use http://sourceforge.net/projects/filezilla/files/FileZilla_Client/3.9.0.2/FileZilla_3.9.0.2_win32-setup.exe/download?nowrap as opposed to the default ...


13

The solution used by some package management systems such as dpkg is to sign the hash: use the hash as input to one of the public key signing algorithms. See http://www.pgpi.org/doc/pgpintro/#p12 If you have the public key of the signatory, you can verify the signature, which proves the hash is unmodified. This just leaves you with the problem of getting ...


10

I totally empathize with you. I have my own approach and I'll happily share it. Some might think it's overkill but I have found it serves me very well. These days I keep my PC ultra-clean. Windows 7, Firefox, Office, Visual Studio, and a handful of freeware I have come to trust over time. I don't do PC gaming so that's about it. For anything and everything ...


9

Your assumption is correct. There is an exception though. If the server providing the file and the page where the hash is are not managed by the same entity. In that case the software developer may want to say "hey people download this from that place but only believe if hash = xxxx". (This might be usefull for CDN's as an example). Having this said, this ...


7

Sometimes the checksums are provided securely, but the download is not. Since MD5 is broken, the security MD5 checksums provide are weaker than more secure checksums, but before MD5 was broken, a securely provided MD5 (e.g. one that was signed with PGP or GPG or Gatekeeper, or fetched over HTTPS) that matched the MD5 of the download was strong evidence that ...


6

Related to Ninite (GUI to download apps without installation procedures) and Chocolatey (command line program more geared for scripting installs): http://portableapps.com/ Tons of apps: from Antivirus, to notepad++, to games like minesweeper, to XAMPP server packages, etc - with the added ease that they aren't "installed" per-se. It's akin unzip and run. ...


4

This is really a problem. Showing checksums on the same site as the file to download is insecure. A person who can change the file can also change the checksum. The checksum should be shown through a complete separated system but this is hardly feasible, because how to tell the user in a safe way where the checksum can be found. A possible solution is the ...


4

This is the precise reason posted checksums often carry a disclaimer saying "This cannot protect against malicious modification of the file". So, the short answer is "they can't provide any protection whatsoever against a deliberately altered file" (although, if the page is delivered over HTTPS, HTTPS itself protects against modification; if the file isn't ...


2

How can MD5 checksums provide any protection against deliberately altered files if there is no way of knowing if the checksum itself has been compromised? You are entirely correct. The goal, then, would be to make your "if" wrong — if we know that a secure cryptographic hash of a file isn't compromised, then we know that the file isn't compromised ...


2

You may also want to check out Unchecky.. Have you ever felt, while installing software, that the installer tries to push additional unwanted programs at all cost? Ever missed a checkbox, and spent hours afterwards removing adware? Ever opened your browser after an installation, only to find out that you have a new homepage, a new search engine, or even a ...


1

What you have to do is ALWAYS downloading software from their official website and NEVER from downloading sites just like CNET (or everywhere else depending on your country). You will avoid lots of bloatware with this kind of habit. These sites are the main source of additional crapwares in installers. Some installers will still have bloatware (Oracle's JRE ...


1

If FDM is not running it can't obviously upload or download anything (make sure it's really not running and not just minimized). When it's running, even if you have completed a download you will still upload, you will be a seeder. I don't think there's a way to stop uploading other than closing the software or deleting the file (note that deleting the files ...


1

You can't modify the MD5 checksum without also modifying the file. If you download the file, then download the hash, and then your computation of the file's has doesn't match what is given, either the hash or the file is wrong or incomplete. If you want to "tie" the file to something external, such as author, machine, etc. it needs to be signed, using a ...


1

Hashes indicate whether your version of the file (the "download") differs from the server's version. They offer no guarantee to the authenticity of the file. Digital signatures (asymmetric encryption + hash function) can be used to verify that the file has not been modified by anyone who does not have the corresponding private key. The file's creator ...


1

How can MD5 checksums provide any protection against deliberately altered files if there is no way of knowing if the checksum has not been compromised either? This is a really good question. In general, your assessment of MD5 manipulation is spot on. But I believe the value of MD5 checksums on downloads is superficial at best. Perhaps after you ...


1

What you want is available here. Instructions to Download Web files to Google Drive Directly or any cloud storage like dropbox,skydrive. Step 1: Head over to http://ctrlq.org/save/ Step 2: Enter the download link in the input box provided. Step 3: Click on “Google drive” to start downloading the file to your Google drive storage. Alternatively you can ...


1

You could just use lynx or some other text mode browser. You can just pass the url that you do know to it and it'll probably be able to get the file for you. If you want a more streamline way to do this then you're going to need to get the final request made to the webserver for this file. If that request is different each time then a text mode browser is ...


1

Making a master mimeTypes.rdf file that you deploy to users is the best solution Open mimeTypes.rdf in an editor that handles XML style docs well (such as Notepad++) Find and replace first line with second: NC:saveToDisk="false" NC:saveToDisk="true" and NC:alwaysAsk="true" NC:alwaysAsk="false" I would also "seed" your master mimeTypes.rdf with some ...



Only top voted, non community-wiki answers of a minimum length are eligible