Re: [Server-devel] ditch all *.img.md5.txt ? (*.img.zip.md5.txt far more useful)

[Adam Holt]

On Mon, Apr 3, 2017 at 6:46 PM, James Cameron  wrote:

> Too much noise is a good argument.
>
> Solutions can be;
>
> 0.  omit the checksums if they are used less than 10% of the time
> (check your logs),
>
> 1.  use one file to contain all checksums, e.g. MD5SUMS,
>
> 2.  don't use Apache indexes, but instead use a script or template to
> generate friendly HTML with file name, checksum, on one line,
>
> Also, it surprises me you-all aren't using any digital signatures on
> the files; but then I think of your user base who wouldn't necessarily
> have the time to be able to verify one, let alone an MD5.
>

Good suggestions all around, thanks James-

For now it seems we're on a deadline, and with no objections over the past
3-4 days, we'll just push ahead Tim's suggestion to ditch/remove
*.IMG.MD5.TXT from http://download.iiab.io to reduce noise.

George,

Can you go ahead now and remove line 72 from
https://github.com/iiab/iiab-factory/blob/master/box/rpi/cp-sd ?
   md5sum $FILENAME > $FILENAME.md5.txt

Keeping line 73...
   md5sum $FILENAME.zip > $FILENAME.zip.md5.txt

--
> James Cameron
> http://quozl.netrek.org/
> ___
> Server-devel mailing list
> Server-devel@lists.laptop.org
> http://lists.laptop.org/listinfo/server-devel
>



-- 
Unsung Heroes of OLPC, interviewed live @ http://unleashkids.org !
___
Server-devel mailing list
Server-devel@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel

Re: [Server-devel] ditch all *.img.md5.txt ? (*.img.zip.md5.txt far more useful)

[James Cameron]

Too much noise is a good argument.

Solutions can be;

0.  omit the checksums if they are used less than 10% of the time
(check your logs),

1.  use one file to contain all checksums, e.g. MD5SUMS,

2.  don't use Apache indexes, but instead use a script or template to
generate friendly HTML with file name, checksum, on one line,

Also, it surprises me you-all aren't using any digital signatures on
the files; but then I think of your user base who wouldn't necessarily
have the time to be able to verify one, let alone an MD5.

-- 
James Cameron
http://quozl.netrek.org/
___
Server-devel mailing list
Server-devel@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel

[Server-devel] ditch all *.img.md5.txt ? (*.img.zip.md5.txt far more useful)

[Adam Holt]

Tim's argument that *.img.md5.txt creates too much noise within
http://xsce.org/downloads is fair (e.g. in future http://download.iiab.io)
since we already have *.img.zip.md5 to verify downloads.  Of course we
can't please everyone, but there's a lot of redundancy built in already,
and checking the compressed *.img.zip is in fact faster for all users.

George, Josh, Rick, Anish & All:

Can we modify the social contract for
publishable/promotable/friendly/secure images @
http://tinyurl.com/iiabimages to ditch *.img.md5 ?  Hence removing the
following line 72 from
https://github.com/iiab/iiab-factory/blob/master/box/rpi/cp-sd ?

   md5sum $FILENAME > $FILENAME.md5.txt

PS the .txt suffix remains very wise b/c Apache generally won't display
*.md5
___
Server-devel mailing list
Server-devel@lists.laptop.org
http://lists.laptop.org/listinfo/server-devel