Something I've just realised... Why are MD5 hashes posted for the installer downloads?!
This hash function was effectivly obsoleted years ago because of the security problems it has - specifically the ones when it's used for this purpose! Couldn't something like the SHA512 - or at a minimum the SHA1 hashes be posted instead? (Or as well as the MD5)
Visit the Community page
Join our forums
Subscribe to our email newsletter
Subscribe with RSS
Follow us on Facebook
Follow us on LinkedIn
Follow us on Twitter
Follow us on Mastodon
Follow us on BlueSky
we cut down a little on the bold please? Sounds like you are shouting at everyone. As for why it is because it isn't up there for security reasons, that is left to the digital signature and the internal CRC check in the installers. It is there simply for verification of a file download for corruption, which is a job it does nicely.
I think its a relict from way back where we had zip filed and no digitally signed exe installers with a build-in check. Its a quick check for a correct download.
And the md5 isnt for the Source code download, its for the installer file!
"What about Love?" - "Overrated. Biochemically no different than eating large quantities of chocolate." - Al Pacino in The Devils Advocate
I think you'll find the point is a little bit behind you; you seem to have missed it somewhat...
The installers have digital certificates, and internal checks anyway, which can be used to check for corruption (and tampering) anyway.
MD5 is a weak, obsolete hash algorithm; why not move onto something more recent (and better), instead of nostalgicly using this one?
You know, whenever I see a post formatted like that, I get a hilarious mental image of a person who alternates speaking in a normal tone and SCREAMING AT THE TOP OF HIS LUNGS!!!!!!!.
Perhaps it's the text version of Tourettes Syndrome - in which case I should be more understanding - but I can't help but chuckle.
And after that, I find it impossible to take anything they say seriously.
I made this half-pony, half-monkey monster to please you.
Cryptographically, MD5 is very weak and should be avoided. For file verification, it is just fine. Even CRC32 would probably be fine for the relatively small files here. Security problems mean nothing if no one is attacking.
Vintage!
Despite a number of posts trying to defend MD5, the fact remains it's a pretty obsolete hash algorithm.
Noone's actually put up a valid argument for sticking with MD5, as opposed to using a better algorithm - e.g. SHA512/SHA1, which was my point.
The reason would be that we are content that is serves the purpose for which we use it, verifying that the download has completed properly. This really is not a big issue and no really wants to get into a fight over it, which I think is likely to happen if someone tried to put up an argument that you would find actually acceptable.
Tim
Things have got to get better, they can't get worse, or can they?
... but I will give You one good argument:
Read the sentence for the md5 hashes! Its only 'for the geeks'. There is no need to use it, cause the installers are signed. Its only an additional service. Thats why there is no need to change it. Perhaps this service will be stopped in the future, but at the moment it is like it is
Use it or let it be...
Your are free to to do what You want.
(If You have time and resources You are free the create and publish any hash You want for all the packages on this site)
Paid for Software more or less?
What You need is OSS!
MD5 is faster than SHA1. Are you happy now?
I think you fail to see the difference between file verification and detection of tampering. The former is to verify that the file was uploaded and downloaded correctly, and that you have the file intended (e.g. not a previous version). This is intended to detect accidental problems. Weaker algorithms can be used for this because the chances of accidental collisions are extremely small. As others have noted, the files are digitally signed, and guess what? Those signatures use a more secure hash algorithm than MD5. In fact, the digital signatures arguably negate the need for any hash on the download page.
Vintage!
lets try this, we already have a tool for verifying and creating md5 hashes on the site.
if you see most other download servers, all that linux stuff etc, look there, all they place the md5 sum there. This is to keep things simple.
Yes md5 can be cheated and yes there can be made two files with the same md5 sum. And yes there are number of word.doc files around in the net specially prepared so that they have same md5 hash. But note that here someone did spent lot of computing power and time to create them and those files are completely different, that means they can not serve as fake of each other. It is just to prove that it is possible, it does not mean it is practicable in reasonable time to produce two files with same md5 hash and they will still work in such a way the user would not notice it.
So for simple download verification this is far then enough, particularly since it is for everybody so simple to check the hash against the downloaded file, even a portable utility for it is here.
Otto Sykora
Basel, Switzerland
This does raise a valid point: PA.c lacks tools to perform hashes other than MD5 on files.
Back when I converted my CD library to a digital one, I used a tool to create MD5 and TIGER hashes of the outputted files. MD5 seemed to be a common standard (I've seen it used on many sites and found many simple drag 'n' drop programs) and TIGER hashes could be used to locate the position of corruption (if I recall correctly). I haven't ripped a CD using EAC and my suped-up REACT script for a while and haven't thought about my old ripping practices.
Limits are for people with no imagination.
There is currently one in testing:
https://portableapps.com/node/19346
Last updated September 9, 2009 - 9:29am
Seek and ye shall find
Tim
Things have got to get better, they can't get worse, or can they?