Comments on: Take advantage of md5 checksums for download validity

By: Generate MD5 Checksums on Windows | Whatsup

Generate MD5 Checksums on Windows | Whatsup — Mon, 08 Mar 2010 07:35:11 +0000

[...] internet) standard has, for years, been checking the md5 hash. Now, there’s plenty of info on the web about creating or checking MD5 or SHA-1 checksums for UNIX or Linux users, but not very much about doing the same on [...]

By: Kirill

Kirill — Sat, 21 Nov 2009 22:58:33 +0000

@martin english: File Checksum Integrity Verifier is very good. Thank you. But when I create an exceptions list and try to use it with -exc parameter it is not working. What can you advise?

By: Rico

Rico — Sat, 21 Nov 2009 07:47:52 +0000

Honestly, the reason i use checksums these days are to verify that large files have been downloaded completely. i’ve had the occasional Linux ISO that seemed to download correctly but after some troubleshooting, i’d find that the checksum didn’t match the one posted. It’s not a concern with torrents, but torrents can be slower than a superfast web server.

There is the issue of malicious code, but honestly i trust my [open] sources and while it’s possible malicious code could be slipped in, it’s such a rare occurrence that i’m really not concerned. Not the most secure security model, i know, but i’ve yet to have it fail me in the fifteen or so years i’ve been downloading from remotes sources.

By: martin english

martin english — Sat, 21 Nov 2009 05:18:42 +0000

Windows users wanting to create or verify MD5 or SHA-1checksums need to look at http://support.microsoft.com/kb/841290

By: Captain Canuck

Captain Canuck — Fri, 20 Nov 2009 21:03:20 +0000

Is it common for people to digitally sign their md5checksum?

By: Jack Wallen

Jack Wallen — Fri, 20 Nov 2009 12:23:44 +0000

@Captain Canuck: That is true. You could, however, create your MD5 hash and then digitally sign it.

By: Captain Canuck

Captain Canuck — Thu, 19 Nov 2009 23:17:14 +0000

“What if someone hacked into the server and replaced the file with a bogus file that contained malicious code?”

Wouldn’t that someone also upload another md5 hash matching the malicious replacement?
usually the md5hash file is in the same directory as the download.