search

dougbtv / docker-asterisk

Some dockerfiles for whipping up an asterisk server
283 stars 135 forks source link

md5 verification of downlods / iax.conf sample removal docs update #46

Closed dougbtv closed 8 years ago

dougbtv commented 8 years ago
ghost commented 8 years ago

MD5 is insecure too... and downloading it over HTTP is just useless as it can be tampered on-the-fly as well. You should, instead, as there is no alternative due to the poor security these websites offer, hardcode the SHA512 checksum of the files and compare it instead of getting it from their respective websites. People will still be able to get the real sources and verify the hash themselves.

dougbtv commented 8 years ago

Valid points for sure.

Hrmm, if I hardcode the sha512 checksum myself... then you have to trust my connection.... I guess, right? (happy to take any input there) I think providing the md5sum as a way to memorialize how it's been verified is just as good/bad as hardcoding it -- at least the way I'm thinking about it here.

Also, it's a maintenance chore to manually verify each release, part of the fun is that I can rebuild quickly. Happy to take any input there.

Likely... The real this is this needs to be addressed at the distribution of the software. @pwnsdx