Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 876977" data-attributes="member: 83059">I generally just download it from the vendor but I spend a lot of time reading the tech news. Once the system is installed I do take a look at their package manager to make sure that the repository and GPG key list is what I expect. If an attack is sophisticated enough to hide from that, I would also worry they can replace any signature verification instructions with tainted ones.Also, you will eventually download additional software packages from those exact same servers from the vendor -- if a vendor is compromised to the point you can&#039;t trust ISOs they vend you, it&#039;s more a sign you shouldn&#039;t use their distro at all.The one exception I&#039;ll note here is that I am assuming you can grab the ISO over HTTPs or the torrent over HTTPS. If not, then you can&#039;t be sure that your download itself isn&#039;t being intercepted mid-stream, at which point you should definitely verify its authenticity.</blockquote>

[QUOTE="MacDefender, post: 876977, member: 83059"] I generally just download it from the vendor but I spend a lot of time reading the tech news. Once the system is installed I do take a look at their package manager to make sure that the repository and GPG key list is what I expect. If an attack is sophisticated enough to hide from that, I would also worry they can replace any signature verification instructions with tainted ones. Also, you will eventually download additional software packages from those exact same servers from the vendor -- if a vendor is compromised to the point you can't trust ISOs they vend you, it's more a sign you shouldn't use their distro at all. The one exception I'll note here is that I am assuming you can grab the ISO over HTTPs or the torrent over HTTPS. If not, then you can't be sure that your download itself isn't being intercepted mid-stream, at which point you should definitely verify its authenticity. [/QUOTE]

Verification