Provide a more secure download mechanism

Question

Hi there,

Please consider serving the multichain binaries over HTTPS and provide a checksum for the tar file. People are doing things like this: https://hub.docker.com/r/kunstmaan/base-multichain/~/dockerfile/

Potential MITM attacks could be trivially exploited against any docker container that is doing this.

Answer 1

Thanks for your comment - indeed we'll be moving the entire MultiChain website over to https with the production release.

Answer 2

FYI the switchover to https/SSL is complete.

Comments

Hey that is great news, but I think it is still important for you to provide a shasum of the tar file so that it can be verified that it has not been modified in transit after being downloaded. Even over SSL this is an issue to be concerned with.