07-09-2023, 03:27 PM
(07-09-2023, 05:40 AM)Kevin Kofler Wrote: How can we trust those TOR links not to contain malware? I would recommend HTTPS instead, failing that HTTP, but not TOR with Onion links given by some random commenter on some forum.
we should be suspicious of tor links. however, if signing keys are properly validated, then installer won't install those altered packages.
this creates another problem, where are signing keys from!? do users check signing keys!?
btw, http (non-ssl) could be hijacked in rare cases.