scummos wrote:

raddison wrote:Agreed. However, some Windows users (and wannabe Neon users) can't use that method without a third party app. And that app is more of a headache than anything else.

I think a SHA256 would be beneficial if hosted on a Ubuntu secure server and would practically cure my headache.

I think the problem is that the KDE mirror network can't use SSL, because SSL doesn't work well with distributed mirror networks, and thus providing SHA sums is not very useful ... GPG signatures, on the other hand, rely on a different path for verification of the key trust, and thus are useful even if both image and signature come from an unreliable source.

I guess people should consider distributing checksums with their release announcements, be it by email or blog.

raddison wrote:False positives are likely to occur quite frequently.

scummos wrote:False positives occur frequently because, frankly, heuristic antivirus software is complete nonsense.

scummos wrote:I think the problem is that the KDE mirror network can't use SSL, because SSL doesn't work well with distributed mirror networks, and thus providing SHA sums is not very useful ... GPG signatures, on the other hand, rely on a different path for verification of the key trust, and thus are useful even if both image and signature come from an unreliable source.

scummos wrote:

raddison wrote:False positives are likely to occur quite frequently.

False positives occur frequently because, frankly, heuristic antivirus software is complete nonsense.

GPG signatures, on the other hand, rely on a different path for verification of the key trust, and thus are useful even if both image and signature come from an unreliable source.