[cross-project-issues-dev] Checksums on downloads

[Glyn Normington <gnormington@xxxxxxxxxx>]

A user has pointed out that checksums downloaded over HTTP do not really add any security since a man-in-the-middle could substitute a checksum to match a substituted download. So why do we bother having these checksums? Would it be better to enable the checksums to be downloaded over https or does that put too much load on the mirrors?

(Of course, the user prefers downloads to be signed, but that's another matter.)

Regards,
Glyn