1

I am currently setting up development environments for BB10 apps on Linux workstations. BlackBerry provides their Momentics IDE for free from (https://developer.blackberry.com/native/downloads/). The catch is that even though the download links to the installer files on this page appear to be HTTPS protected, they actually redirect you to an HTTP download server (using the "302, Moved Temporarily" response). The same is true of the links to the checksums for the installer files (they are all in MD5 anyway, which is considered broken in this context).

I can force the download server to which I'm redirected to use HTTPS, but only by creating an exception for the certificate mismatch (the certificate appears to be for BB's hosting provider, Akamai).

Does anyone know of an alternate, secure way to acquire the Linux installer for the BB Momentics IDE and/or hashes for the same (some kind of developer registration perhaps)? My only recourse at this point seems to be to file a ticket with the BlackBerry Issue Tracker and see if there's any response.

(PS: I assume this is less of an issue for the Windows version of the IDE, since MS provides code signing for installers from verified developers, but I would rather not split up the dev environment into half Win/half Linux)

  • the certificate appears to be for BB's hosting provider, Akamai that's perfectly fine and secure. And MD5 is not that broken, it's still very hard to alter a file and yet make it produce the same hash. Finally your solution looks good, ask them for some hashes, preferably SHA1 or longer. – user42178 Mar 29 '15 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.