search

ElliotKillick / Mido

The Secure Microsoft Windows Downloader
https://elliotonsecurity.com
MIT License
531 stars 23 forks source link

[Feature request] Disable integrity check #13

Open kroese opened 8 months ago

kroese commented 8 months ago

It would be nice to have a commandline parameter to disable the integrity check, because it takes quite some time and for me personally its not really necessary as the image is downloaded from a trusted source.

EDIT: An alternative would be to have a flag to let Mido just return the download url, and let me handle the download/processing myself.

ElliotKillick commented 6 months ago

This feature is planned. Verification can take a while, especially if you have a slow storage drive.

In Mido, we strive for zero trust (as does Microsoft). While it's tempting to assume Microsoft is a huge company and therefore cannot be compromised, they can be compromised, just like any other entity. I find it unlikely a compromise of this scale occurs on an ISO, but it's nice to have the hashes just in case.

Also, integrity verification isn't just for security because it may also reveal errors in network transmission, writing to the disk, or if a bit flip occurs from a cosmic ray during the large download (needless to say - unlikely events).