#5634: build scripts do not verify dowloaded source tarballs
------------------------------+---------------------------------------------
Reporter: cypherpunks | Owner: mikeperry
Type: defect | Status: new
Priority: normal | Milestone:
Component: TorBrowserButton | Version:
Keywords: | Parent:
Points: | Actualpoints:
------------------------------+---------------------------------------------
I may be miscalculating the risks but shouldn't all code one downloads at
least be checked against a hash sum fetched over https or multiple network
connections/exits?
I assume official binaries are not built behind Tor or an insecure wifi -
though others may want or need to do that - but Erinn would make an
interesting target for ISP intrusion or other scenarios.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5634>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
[email protected]
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs
