:celeste_hearts_lesbian: :celeste_hearts_trans: :celeste_hearts_demisexual: flori_ava_star@[matrix]conf:~:cursor_blinking: (@star)

flori_ava_star@[matrix]conf:~

@star@amazonawaws.com

if you use MD5 or SHA1 for literally ANYTHING in 2026, STOP. GET SOME HELP. DO NOT

1❤️4

flori_ava_star@[matrix]conf:~

@star@amazonawaws.com

even for seemingly inane tasks, simply DON'T!!!!

❤️2

Xerz 💗 @xerz@masfloss.net

@star sometimes, the only available hash for a file is MD5 and then I

❤️1

[4fbb09] @5225225@furry.engineer

@xerz @star to be fair, a lot of the cases where a file hash is provided (foo.net listing the hash of a file you download... from foo.net) is simply not security relevant.

unless the file is actually being hosted on a mirror and the file hash isn't.

in that case, yeah, it makes sense (but also you still kinda need to trust the mirror because in 99% of cases people won't check the hash unless you do it automatically)

❤️1

flori_ava_star@[matrix]conf:~

@star@amazonawaws.com

@5225225 @xerz noooooo, "not security relevant" is not a good excuseeee!!!! this is how usage of md5 proliferates/continues lkjhslkjhdfglkjhsdflkjhsdfglkjhsdgflkjhsdgflkjh

there are simply much better, much safer, much faster hashing algorithms out there! like sha512 or blake3 my beloved

❤️1

[4fbb09] @5225225@furry.engineer

@star @xerz i mean for the case of file checksums my argument is to not provide a md5 it's to not provide a hash at all. no one checks it, and checking it only protects against disk corruption on your end (which, sure. whatever.), or the file getting corrupted on the server end.

Xerz 💗 @xerz@masfloss.net

@5225225 @star ...huh? I check hashes constantly tho, in particular for Windows software and retro stuff, plus my Nix checks hashes constantly in an automated fashion, just as e.g. torrents do

this seems like a really easy way to lose track of history and force everyone to be vulnerable just because the majority doesn't understand hashes

[4fbb09] @5225225@furry.engineer

@xerz @star the specific case i'm talking about is page on https://foo.net/ with a download link to https://foo.net/file.bin, and a hash (secure or otherwise) on that page

the hash there is pure security theatre. anyone who can tamper with the file can tamper with the hash to match their tampering. okay, there's more vague benefits of "it's easier to check that the hash hasn't been tampered with than the file" (if anyone is actually monitoring that...), but for the individual, it's not as meaningful

for the case of nix, yes, the hash there is load bearing (especially since certificate checking is disabled in nixpkgs fetchurl if a hash is given, so the HTTPS doesn't protect you)

Juan D. Jara :yeah_waffy: @javascript@app.wafrn.net

@5225225 @star @xerz

when someone sends you a md5 hash in the year 2026