Re: [freenet-support] No SHA1 or MD5 hashes for the installer?

2011-01-05 Thread Matthew Toseland
On Saturday 01 January 2011 19:08:05 Fabio Spelta wrote: We do, but it's not very prominent because most users don't use it. Reread the download page. I would rather suggest you to put that directly into the install instructions here. http://freenetproject.org/install.html I didn't

Re: [freenet-support] No SHA1 or MD5 hashes for the installer?

2011-01-05 Thread Matthew Toseland
On Tuesday 04 January 2011 16:22:20 Daxter wrote: On Jan 1, 2011, at 11:57 AM, Matthew Toseland wrote: On Saturday 01 January 2011 17:51:41 Fabio Spelta wrote: Glad to know it. Where are they published? I'd suggest you to publish the instructions and the links to do so right into the

Re: [freenet-support] No SHA1 or MD5 hashes for the installer?

2011-01-05 Thread Matthew Toseland
On Tuesday 04 January 2011 16:56:14 Fabio Spelta wrote: Am I doing something wrong? You have to install the signer's public key. I strongly agree, this should be documented step by step because it's very important. To get mr. Toseland's latest key run this: gpg --recv-keys

Re: [freenet-support] No SHA1 or MD5 hashes for the installer?

2011-01-05 Thread Fabio Spelta
Which means that if somebody is attacking you he will substitute both the signature file and my key when you download it. So you gain very little, unless you have some other trust path. Well, they should also hijack the connection with the keyserver site. While being the man in the middle in

Re: [freenet-support] No SHA1 or MD5 hashes for the installer?

2011-01-05 Thread Matthew Toseland
On Wednesday 05 January 2011 19:49:36 Fabio Spelta wrote: Which means that if somebody is attacking you he will substitute both the signature file and my key when you download it. So you gain very little, unless you have some other trust path. Well, they should also hijack the

Re: [freenet-support] No SHA1 or MD5 hashes for the installer?

2011-01-05 Thread Matthew Toseland
On Wednesday 05 January 2011 19:49:36 Fabio Spelta wrote: Which means that if somebody is attacking you he will substitute both the signature file and my key when you download it. So you gain very little, unless you have some other trust path. Well, they should also hijack the

Re: [freenet-support] No SHA1 or MD5 hashes for the installer?

2011-01-04 Thread Daxter
On Jan 1, 2011, at 11:57 AM, Matthew Toseland wrote: On Saturday 01 January 2011 17:51:41 Fabio Spelta wrote: Glad to know it. Where are they published? I'd suggest you to publish the instructions and the links to do so right into the install instructions. We do, but it's not very

Re: [freenet-support] No SHA1 or MD5 hashes for the installer?

2011-01-04 Thread Fabio Spelta
Am I doing something wrong? You have to install the signer's public key. I strongly agree, this should be documented step by step because it's very important. To get mr. Toseland's latest key run this: gpg --recv-keys 75941D88 Then you will have the chance to verify the signature. Some

Re: [freenet-support] No SHA1 or MD5 hashes for the installer?

2011-01-01 Thread Matthew Toseland
On Thursday 30 December 2010 23:46:48 Fabio Spelta wrote: Hello all. I tried to install Freenet running the Java WebStart tool. It asked me if I wanted to continue with the installation after presenting me the X.509 certificate of Matthew Toseland whose fingerprint is

Re: [freenet-support] No SHA1 or MD5 hashes for the installer?

2011-01-01 Thread Fabio Spelta
You don't. Trust requires money (to buy a cert). Only rich people have money. Rich people can't be trusted. Therefore nobody can be trusted. ;) :) Seriously, you can, and should, check the GPG signature. Glad to know it. Where are they published? I'd suggest you to publish the

Re: [freenet-support] No SHA1 or MD5 hashes for the installer?

2011-01-01 Thread Matthew Toseland
On Saturday 01 January 2011 17:51:41 Fabio Spelta wrote: You don't. Trust requires money (to buy a cert). Only rich people have money. Rich people can't be trusted. Therefore nobody can be trusted. ;) :) Seriously, you can, and should, check the GPG signature. Glad to know

Re: [freenet-support] No SHA1 or MD5 hashes for the installer?

2011-01-01 Thread Fabio Spelta
We do, but it's not very prominent because most users don't use it. Reread the download page. I would rather suggest you to put that directly into the install instructions here. http://freenetproject.org/install.html My two cents. Again, best wishes and many thanks -- Fabio