> So you vandalized their site
I shouldn't have but I was too mad at the time.
> over a problem you don't understand?
What exactly don't I understand?
* They allowed ANY newly registred user to edit official downloads.
* On top of that, they clearly don't have the manpower to constantly monitor
the wiki for vandalism. My changes stayed for more than 6 hours, and were
probably only reverted because they were so conspicious. If someone replaced
the downloads with malicious packages without changing anything else, they
could've stayed there for much longer.
* I agree that collaborative wikis are good. But the main, download and
verification pages should still be locked. There isn't anything truly useful
for a non-admin user to add there anyway.
* They have been defaced several times by spammers, but they sill didn't lock
the pages, and even openly admitted that it is intended this way.
http://lists.rpmfusion.org/pipermail/rpmfusion-developers/2013-July/015359.html
> You didn't gave them any useful idea (as they point out), or us.
It should be very obvious what to do.
* The download page and the verification page are editable by any newly
registered user.
Then lock the pages.
* No HTTPS, so malicious packages can be inserted by a man in middle.
Then add HTTPS support.
> And you don't recommend an almost free distribution unless the addition of
extra non-free binaries
I'm just being realistic here. A common user won't accept such an offer.
> (now those sure are safe!) can be done from a HTTPS
RPM Fusion hosts free software too. MP3 / H.264 decoders are free software,
but they can't be used in US because of patents. It also hosts some software
that doesn't meet Fedora strict quality standard, eg. VirtualBox.
> The only useful suggestion from this tread comes from Andrew (I signed the
key, thanks for the hint).
AFAIK this doesn't provide any additional security over MD5 over HTTPS to a
common user who doesn't use Web of Trust.
Also, why is MD5 link? MD5 checksum can be embedded in the page itself and
it'd be way shorter than the link to it.
