Talk:Hashes & Checksums

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 08:02, 17 January 2008 (edit)
Soulstace (Talk | contribs)
(Why https doesn't completely solve the issue)
← Previous diff
Revision as of 08:19, 17 January 2008 (edit) (undo)
Soulstace (Talk | contribs)

Next diff →
Line 3: Line 3:
--[[User:Whiteboy|whiteboy]] 06:07, 3 Oct 2006 (CEST) --[[User:Whiteboy|whiteboy]] 06:07, 3 Oct 2006 (CEST)
 +----
Hello MrElvey, Hello MrElvey,
Line 8: Line 9:
Thanks for contributing to the article :) Thanks for contributing to the article :)
-The main issue with ''user-generated'' hashes, is that there is no way to verify that the hash is correct (even when using an encrypted https/ssl connection).+The main issue with ''user-generated'' hashes, is that there is no way to verify that the hash is correct (even when using an encrypted https/ssl connection). It is entirely possible that a ''user-generated'' hash was generated from a corrupt firmware file downloaded from dd-wrt's website. This is precisely why the hashes '''must''' be posted by the developers themselves (and as I have mentioned, Eko has begun doing just that). All a ''user-generated'' hash really tells you is that the firmware file you downloaded matches the firmware file another user downloaded... and if that other person has tested the firmware reliably, you can, with ''marginal'' assurance, assume it is not going to brick your router.
- +
-It is entirely possible that a user-generated hash was generated from a corrupt firmware file downloaded from dd-wrt's website. This is precisely why the hashes must be posted by the developers themselves (and as I have mentioned, Eko has begun doing just that).+
The encrypted connection would put an extra layer of security around the hashes, however it still does not solve our original problem of the user-generated hashes themselves. The encrypted connection would put an extra layer of security around the hashes, however it still does not solve our original problem of the user-generated hashes themselves.
Line 17: Line 16:
--[[User:Soulstace|Soulstace]] 09:02, 17 January 2008 (CET) --[[User:Soulstace|Soulstace]] 09:02, 17 January 2008 (CET)
 +
 +----

Revision as of 08:19, 17 January 2008

update for sp2?

--whiteboy 06:07, 3 Oct 2006 (CEST)


Hello MrElvey,

Thanks for contributing to the article :)

The main issue with user-generated hashes, is that there is no way to verify that the hash is correct (even when using an encrypted https/ssl connection). It is entirely possible that a user-generated hash was generated from a corrupt firmware file downloaded from dd-wrt's website. This is precisely why the hashes must be posted by the developers themselves (and as I have mentioned, Eko has begun doing just that). All a user-generated hash really tells you is that the firmware file you downloaded matches the firmware file another user downloaded... and if that other person has tested the firmware reliably, you can, with marginal assurance, assume it is not going to brick your router.

The encrypted connection would put an extra layer of security around the hashes, however it still does not solve our original problem of the user-generated hashes themselves.

Perhaps you realize this already, but just thought I would mention it for our users.

--Soulstace 09:02, 17 January 2008 (CET)