sha256sum instead of sha1sum wanted

[ntysdd]

Since sha1 is known to be broken, a safer digest algorithm is prefered on strawberryperl.com

[guest20]

Where do you get the sums? Is it the same webserver as the binaries?

[ntysdd]

@guest20 https://strawberryperl.com/releases.html
Don't know whether it is the same webserver.

[guest20]

If it's just as easy for an attacker replace the list of sums as it is for her to replace the binary or even the link people use to get the binary, a longer sum/digest won't stop her sneaking a bad binary onto the downloads page.

"sha1 is broken" is really only a useful discussion if you're relying on a sha1-based signature as the soul mechanism of verification, and everything else is locked down so hard that the attackers only option† is to try and make her evil binary match the well-known sum of a legitimate release so that she can replace the released version with hers.

That's not to say that wanting to be able to verify builds is not important, but rather to say that switching to a different sum is not going to deliver much more than a longer and yet equally trustworthy string to copy/paste.

The containerised builds look relatively new^, and like a huge step in that direction, though it seems to be a struggle. Maybe also using the Releases tab on github could provide a second way to verify the sums of the binaries without breaking the bank?

That said, i'm just some weirdo with a github account, and not a contributor to the project (unless comments on github issues count as contirbuting)
__
†. that is, the people downloading the binary use a back channel to get the sum of the new release before they visit the compromised download page, and then they verify the downloaded artefact using that sum and then actually refuse to run the binary if it does not match the sum (rather than saying "well, I boxed in an hour for this on my calendar, and I'm not spending my time trying to get in touch with the project to find out if they're breached or not, I'll just run this anyway - i'm sure the corp antivirus will catch it if something's wrong").
^. since the repo only contains a patch directory for 5.34 and I refuse to believe that it's just been smooth sailing until now, and so nothing's needed patching up until 5.34

[ntysdd]

@guest20
Using a "known to be broken" hash digest algorithm makes people think that you are not security-aware, or think that the web site is out-dated.
And although a hacker can over-writes these sums as (almost) easily as replace binaries, providing a hash digest makes us far more easily to notice the intrusion. And that's why a hash digest is provided in the first place.

[genio]

This is a change that will take some time. We'll work on it soon.

[guest20]

@nysdd how will you notice the change in the sum? Do you use a tool to monitor the download page?

[ntysdd]

@guest20
You spell my name wrong.
Just google the sums.

[guest20]

@ntysdd do you mean that a user should google "what is the sum of strawberry perl 5.34" and check agaisnt the google result?

[ntysdd]

@guest20 A user MAY google the hash string.

And I say, it allow "us to more easily to notice the intrusion". NOT every user need to do the check to make us to notice the intrusion, because this is an open-source community, RIGHT?

And, IN CASE you don't know that already, there are already sha1sums on the site, and SHA-1 is a cryptographic hash algorithm JUST like SHA-2, only weaker, and everything you say about SHA-2 also applies to SHA-1.

Free free to persuade developers to REMOVE the SHA-1 sums.

[guest20]

@ntysdd isn't the point of the sums to stop users installing malicious stuff? The project noticing a breach is secondary to that goal, and is only valuable if the member who notices does something that stops users downloading/installing a malicious binary.

Its not a monitoring system for the people who upload the binaries, its (supposed to be) a protection for the people downloading them.

Your very fun sarcastic suggestion to remove sums doesn't improve the situation for anyone, providing a back channel for verifying the sum either by signing them, or publishing them in a different place than the binary does.