I had received a bad comment about my project but without any explanation. If you too think this idea is bad, please tell me why.

This system tries to avoid software publishers' cooperation with some governments e.g. Mozilla and China for spying Chinese citizens, (countries without independent security audit firms.)

The goal is to have universal identical downloads.

It consists of a download manager that sends download titles to a server and asks for checksum. That server sends checksum as reported by users from other countries. Queries can be by specifying version or just asking for the last version.

A concern would be if this server also can be purchased by goverments. So the download manager keeps a list of checksum of all downloaded software and it can later check this list by server through different proxies. There is a chance that some of the popular proxies will be betraying and reveals user location to the server so this is for addressing that, too. Also a client download manager can download the whole database and compare it when a query is done through different proxies.

The download manager checksum log is not allowed to be manipulated by other application.

Also a need in western countries, too, because with the cooperation of telecom companies software publisher can know if an IT company is downloading or ordinary user which cannot detect an unknown spyware

This system can also be P2P but without a fully decentralized protocol, it doesn't make any effect in being lobby-proof.

(if you liked it I started a fundrazr.com project for it)

New contributor
East Activist is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

closed as off-topic by schroeder Feb 12 at 9:57

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • You just described a stripped down version of "blockchain" – schroeder Feb 12 at 10:20
  • @schroeder I think you taught that users download files from the server. The server act like virustotal but with diffrent that you can query checksum by title – East Activist Feb 12 at 10:28
  • 1
    This question is too broad for our Q&A format. It also lacks understanding of how software development works. In your example, Adobe is forced by China to make a backdoored version of their product. Adobe releases this version in China. China blocks all other access to other versions of the product. How does your idea help? – schroeder Feb 12 at 10:28
  • If any user can access this special server of yours, then they can also access the checksum hashes of any product from any independent source. I'm not sure what your idea adds. – schroeder Feb 12 at 10:29
  • 1
    You might be interested in distributed file distribution network like Freenet's and BitTorrent's DHT approach to this. Rather than verifying hashes, you instead can make the hashes become the files' address. Because once you start distributing hashes, it no longer matters where or who you download the files from, the hashes is the file. – Lie Ryan Feb 12 at 12:35

Browse other questions tagged or ask your own question.