I prefer CIC's comment-answer, but the way I have always viewed it is that collisions aren't always useful.

Maybe two text strings can have a collision and if they fit in a password input field, that's a problem.

But what are the odds of useful malicious code, that actually works, being injected into another program and generating the same checksum? Probably absurdly small.

You'd need a wonder-computer to take the legit software + malicious code, and figure out what kind of garbage data needs to be added to the file in order to create the same checksum and filesize and all of that.

So in that regard, not really a security concern.

I prefer CIC's comment-answer, but the way I have always viewed it is that collisions aren't always useful.

Maybe two text strings can have a collision and if they fit in a password input field, that's a problem.

But what are the odds of useful malicious code, that actually works, being injected into another program and generating the same checksum? Probably absurdly small.

You'd need a wonder-computer to take the legit software + malicious code, and figure out what kind of garbage data needs to be added to the file in order to create the same checksum and filesize and all of that.

This of course assumes the hash is preimage resistant. The wonder-computer being something that not only make the infeasible feasible, but also finding a collision that has both functional legit software + malicious code.

So in that regard, not really a security concern.