Re: checksum suggestion

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Tom Horsley wrote:
There is little doubt that sometime soon some fiendish
mathematician somewhere will discover that sha256sum
is really hopelessly broken and only a fool would ever
have used it, then we'll all have to switch to
shaalephnullsum or some such :-).

How about we forestall all this nonsense by creating
a new rpm that just has one symlink in it named

best-sum

Then everyone can just always use the best-sum program
when checking isos, etc and when a new release comes
out, it can come with a new best-sum package that installs
the appropriate symlink to the appropriate actual
checksum tool :-).

I just posted a minuscule one liner in response to Stan's comment in the 'sha256sum' thread, it could be a two liner and include your suggestion. Better yet would be to make the checksum file a shell script which one could source and do the right thing no matter what comes in the future. That would be convenient for easily confused users.

But barring some huge breakthrough in computing power or theory, sha256sum will be safe for decades.

Security note: any checksum is only as secure as the source of the checksum. If you get the checksum from a fedora official site then sha256sum is better than md5sum to protect against deliberate tampering. But if you are checking to catch transmission errors, which are random, then md5sum will catch all but one in billions. In other words, if an evildoer were tampering with the ISO image, they would probably tamper with the checksum you got from the same place, so sha256sum is subject to deliberate attacks from that method.

I think I got my official checksums from the wiki, I did download mine from an official site, I am not a trusting person. ;-)

--
Bill Davidsen <davidsen@xxxxxxx>
  "We have more to fear from the bungling of the incompetent than from
the machinations of the wicked."  - from Slashdot

--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [Fedora Magazine]     [Fedora News]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Maintainers]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [Fedora Fonts]     [ATA RAID]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [SSH]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Tux]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Asterisk PBX]     [Fedora Sparc]     [Fedora Universal Network Connector]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux