File Hashes for Far Downloads

Discussing the site, suggestions, criticism etc.
Post Reply
nrcuster@gmailcom
Posts: 2
Joined: Fri 11 Mar, 2022 16:54

File Hashes for Far Downloads

Post by nrcuster@gmailcom »

I normally like to have a file hash using one of the four more popular algorithms (MD5, SHA-1, SHA256, or SHA512) for anything I download from an open source forum before installing it on my PC. I don't see a place to obtain these for the FAR Manager downloads page.

Can you please publish these on the download page or tell me where I can obtain them on the FAR Manager site?
User avatar
HaRT
Moderator
Posts: 10179
Joined: Tue 30 Aug, 2005 17:21
Has thanked: 161 times
Been thanked: 302 times

File Hashes for Far Downloads

Post by HaRT »

nrcuster@gmailcom, imagine you have these hashes. What kind of attack will they protect you against? Or what other purpose should they serve?
Фар есть инструмент, а не нянька. © 2009 DrKnS
nrcuster@gmailcom
Posts: 2
Joined: Fri 11 Mar, 2022 16:54

File Hashes for Far Downloads

Post by nrcuster@gmailcom »

Generally, it provides the downloader the assurance the file they have downloaded has not been tampered with since it was hosted for downloading. Hashing has a large number of applications in cybersecurity, centering around the ability to verify that data is legitimate. With a secure hashing algorithm, one can verify that a downloaded file matched what was intended. In fact, many projects provide hashes alongside their downloads. This provides some peace of mind that a file is authentic and has not been altered in transmission.

In addition, some online services provide the ability to look up whether a file is known to be malicious based on file hash. Rather than uploading the entire file for the service to analyze, one can just provide the hash, since it uniquely identifies the data in the file. Often, vendors will provide hashes with downloads of firmware or other critical files. This can provide an extra level of security Isafety when downloading files and help
to prevent watering hole attacks. Additional safety measures are never a bad thing, especially when it comes to downloading files, even from trusted sources.

Good luck with your project. I'll not be installing.
User avatar
HaRT
Moderator
Posts: 10179
Joined: Tue 30 Aug, 2005 17:21
Has thanked: 161 times
Been thanked: 302 times

File Hashes for Far Downloads

Post by HaRT »

nrcuster@gmailcom, what you write is all well-known but you're missing the point: if someone was able to tamper with the file you're going to download from the site, they could have tampered with the web page listing the hashes too, so you get only an illusion of increased security. What really gives more security for downloads is a valid digital signature (backed by publisher's verifiably correct certificate), and some projects do publish these, but it's not that common (yet).

If you are concerned with the download being modified by a MITM (man in the middle), this is addressed by TLS (in particular, by downloading via HTTPS rather than HTTP).

As for the the online malware scans (e.g. virustotal.com), such services are usually capable of checking content by its URL, so you don't need to upload anything.
nrcuster@gmailcom wrote: Thu 17 Mar, 2022 20:34 Good luck with your project. I'll not be installing.
Good luck with your illusions and wishful thinking.
Фар есть инструмент, а не нянька. © 2009 DrKnS
User avatar
Grom PE
Posts: 34
Joined: Sun 21 Jun, 2015 14:24
Has thanked: 5 times
Been thanked: 2 times
Contact:

File Hashes for Far Downloads

Post by Grom PE »

The download webpage (farmanager.com/download.php) has the same domain and server as the files you download from it, so hashes don't add extra security.

If the download location was different, then hashes would help in removing the question of trust for that different download location.
pepak
Posts: 585
Joined: Sun 13 Jul, 2008 11:18
Has thanked: 17 times
Been thanked: 48 times

File Hashes for Far Downloads

Post by pepak »

Two notes:

1) There's no need to be confrontational. On either side.

2) I can see one benefit of the hashes, in particular for the rather long-term stable releases - if the same hash appeared on both the FAR website and a third-party download server, it would significantly increase the probability that both host a valid file. Could it still be substituted with a fake one? Sure. But it'd still be a little better than what we have now.
User avatar
buniak_a_h
Posts: 3607
Joined: Sat 20 Apr, 2013 00:17
Location: Санкт-Петробад
Has thanked: 182 times
Been thanked: 534 times
Contact:

File Hashes for Far Downloads

Post by buniak_a_h »

Last edited by HaRT on Fri 18 Mar, 2022 18:48, edited 1 time in total.
Reason: Offtopic hidden
Yegor
Posts: 1184
Joined: Mon 04 Apr, 2005 13:41
Location: San Ramon, CA / Kharkov, UA
Has thanked: 23 times
Been thanked: 37 times

File Hashes for Far Downloads

Post by Yegor »

pepak wrote: Fri 18 Mar, 2022 16:19 2) I can see one benefit of the hashes, in particular for the rather long-term stable releases - if the same hash appeared on both the FAR website and a third-party download server, it would significantly increase the probability that both host a valid file. Could it still be substituted with a fake one? Sure. But it'd still be a little better than what we have now.
As far as I understand, the reality is that the Far installations you can download from Github and from the main website will have different hashes because they are built by different processes.
Мы не можем ждать милостей от Фара, взять их у него — наша задача! (C) Мичурин
Post Reply

Return to “General www.farmanager.com Discussions”