Re: PGP verifyable Squid code

On Mon, 8 Jun 1998, Michael Samuel wrote:

> md5sum would be a bit more useful.

IMO, MD5 is less useful because it does not authenticate the author of the
information. Anybody can generate valid MD5s over invalid content so MD5 does
not protect you from the man-in-the-middle attack.

However, since MD5 was much easier to add than PGP, we now post MD5s for
Squid source archives and diffs. :)

Squid-1.2:
http://squid.nlanr.net/Squid/1.2.beta/md5s.txt

Squid-1.1
http://squid.nlanr.net/Squid/1.1/md5s.txt

> But, how can you trust the real Squid anyway?

Huh?
 
Alex.
Received on Mon Jun 08 1998 - 10:15:20 MDT