This question already has an answer here:
I actually check for TLS before I use any exe files.
I've been trying to download a bootable usb creator tool for windows. However, I can't find a single one that actually uses any form of TLS (or even a torrent).
Even canoncial seems to support this. http://www.ubuntu.com/download/desktop/create-a-usb-stick-on-windows
This feels like a massive security hole. Why is it such common practice?