Re: include SHA1/MD5 hash/digest of setup.exe, and use HTTPS

2012-09-27 Thread Christopher Faylor
On Thu, Sep 27, 2012 at 01:04:52AM -0700, Bry8 Star wrote: >Is "cygwin.com" domain DNSSEC signed yet ? > >can "setup.exe" be able to re-programmed to connect with dnssec signed >cygwin.com (by using a builtin dnssec supported basic dns resolver) ? >and can also be made to use the pre-included self-

Re: include SHA1/MD5 hash/digest of setup.exe, and use HTTPS

2012-09-27 Thread Bry8 Star
Is "cygwin.com" domain DNSSEC signed yet ? can "setup.exe" be able to re-programmed to connect with dnssec signed cygwin.com (by using a builtin dnssec supported basic dns resolver) ? and can also be made to use the pre-included self-signed cert's key for a secured & encrypted connections (for obt

Re: include SHA1/MD5 hash/digest of setup.exe, and use HTTPS

2012-09-27 Thread Bry8 Star
Sorry, i have failed arrange my thoughts & requests properly and then post. i have been requesting in IRC, but no one seems to care a bit. if it is too hard for devs, to do any of the mentioned things/requests/improvements, PLEASE at-least show the SHA1 (over http) next to setup.exe. . think of,

Re: include SHA1/MD5 hash/digest of setup.exe, and use HTTPS

2012-09-26 Thread Christopher Faylor
On Wed, Sep 26, 2012 at 09:42:57AM -0400, Ryan Johnson wrote: >tl;dr: publishing a checksum for setup.exe is a good idea, https makes >little or no sense in this setting, and cryptographic signatures for >packages would be nice to have but would burden volunteers while >providing incomplete prot

Re: include SHA1/MD5 hash/digest of setup.exe, and use HTTPS

2012-09-26 Thread Ryan Johnson
tl;dr: publishing a checksum for setup.exe is a good idea, https makes little or no sense in this setting, and cryptographic signatures for packages would be nice to have but would burden volunteers while providing incomplete protection. (response follows) On 26/09/2012 2:22 AM, Bry8 Star wro

include SHA1/MD5 hash/digest of setup.exe, and use HTTPS

2012-09-25 Thread Bry8 Star
Hello, Please include SHA1/MD5 hash/digest code of "setup.exe" file, on webpage next to "setup.exe" download url-link. so we know for sure, if we have a correct file or not, and someone in middle (MITM) has not changed it. Windows users prefer to verify files rather with sha1/md5 etc, than using a