There are a lot of good and reliable sources, like Tails or a specific ISO-image, eg. debian-live-8.7.1-amd64-gnome-desktop.iso.

How can I ensure that my Internet connection is delivering the original/expected and 100% reliable resources?


My imagined solutions (but need a complete answer with a rationale):

  • use the checksum files. Today SHA1 is not perfect (need SHA256) ... is it 100% for integrity/authenticity of big files? What is the size/reliabilty mathematical relation in this case?

  • use my house internet connection. How to check if the download page (at cdimage.debian.org or tails.boum.org in the examples) is not corrupted before getting a reliable system and browser? How to do it in China, for example?

  • Why is SHA1 rejected? You would have to be able to design the replacement file with the exact size and hash as the expected file. – schroeder Mar 26 '17 at 15:42
  • Hi @schroeder, thanks. Hum... my comment about SHA1 is not central to the discussion... but a rationale about "not use SHA1" is here (see "CONTEXT AND EXPLANATIONS"). – Peter Krauss Mar 26 '17 at 16:09

When downloading an image, there is usually a checksum file provided as well (delivered over https). When downloading individual packages, many Linux distros have GPG verification built into the package manager. And for general network operations, increasingly the web is moving towards using TLS to secure everything.

  • Thanks @XiongChiamiov, good summary. My link to cdimage.debian.org is HTTP, but I try HTTPS and it is also valid (!); so a good practice, as you pointed, is to use HTTPS. And about the domain, need to be DNSSEC? About the iso file, 1.3Gb, there are a minimal checksum lenght to ensure the integrity of a big file (when comparing with eg. 1.3kb file)? An the browser (any tool for download), something simple as cURL or wget is better than complex Chrome? – Peter Krauss Mar 27 '17 at 4:04
  • A good cryptographic hash function (for instance, any SHA-2 or SHA-3 algorithm) will operate just as well on a large file as a small one. As to the rest, it depends on how paranoid you want to be; I personally wouldn't worry about DNSSEC or using Chrome to download the files. – Xiong Chiamiov Mar 27 '17 at 22:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.