<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=EN-US link=blue vlink="#954F72"><div class=WordSection1><p class=MsoNormal>I usually use <a href="http://mirrors.kernel.org">http://mirrors.kernel.org</a> as my main site for downloading CD images. They <i>do</i> list the checksums and signatures quite easily. Also, while typing the URL, I decided to check if they support https – yes, they do! So: <a href="https://mirrors.kernel.org">https://mirrors.kernel.org</a></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman",serif'><o:p> </o:p></span></p><div style='mso-element:para-border-div;border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal style='border:none;padding:0in'><b>From: </b><a href="mailto:rick@linuxmafia.com">Rick Moen</a><br><b>Sent: </b>Tuesday, March 8, 2016 11:51 PM<br><b>To: </b><a href="mailto:conspire@linuxmafia.com">conspire@linuxmafia.com</a><br><b>Subject: </b>Re: [conspire] [Felton LUG] Fwd: Apple Users Targeted</p></div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman",serif'><o:p> </o:p></span></p><p class=MsoNormal>Quoting Paul Zander (paulz@ieee.org):</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>> So back to my personal project of downloading assorted Linux iso files. </p><p class=MsoNormal>> </p><p class=MsoNormal>> Finding the checksums sometimes isn't easy.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>You're right, and it's annoying, and I think we can blame everyone's </p><p class=MsoNormal>mania for a simple, drool-proof WebUI:</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>> For example, go to www.debian.org</p><p class=MsoNormal>> </p><p class=MsoNormal>> In the upper right is a box, "Download Debian 8.3"</p><p class=MsoNormal>> </p><p class=MsoNormal>> Click on the box and it starts downloading </p><p class=MsoNormal>> debian-8.3.0-amd64-i386-netinst.iso</p><p class=MsoNormal>> But where is the file with the checksums for that particular file?</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Not shown anywhere near that soothingly green button, nor even anywhere</p><p class=MsoNormal>on that page. The webmonkey in question should be ashamed.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>It's findable if you know where it _probably is_, which is in the same</p><p class=MsoNormal>directory tree the ISO is in. If you have years of working around</p><p class=MsoNormal>stupid webmonkeys the way I do, the subsequent drill is almost</p><p class=MsoNormal>automatic:</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>1. Where's the download link specifically? Right-click the download</p><p class=MsoNormal>button, to grab the URL. Editify. It's...</p><p class=MsoNormal>http://cdimage.debian.org/debian-cd/8.3.0/multi-arch/iso-cd/debian-8.3.0-amd64-i386-netinst.iso</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Strip off the filename portion, to get the basedir URL. Load that in a</p><p class=MsoNormal>browser. URL is (of course)</p><p class=MsoNormal>http://cdimage.debian.org/debian-cd/8.3.0/multi-arch/iso-cd/ .</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Well, howdy there! Your basic 1993 rivets-and-suspenders Web page with</p><p class=MsoNormal>a bunch of too-much-text, a page that haplessly fails to put most-needed</p><p class=MsoNormal>stuff on top. A page written by engineers, yay. It's so bad that</p><p class=MsoNormal>oldtimers will feel right at home. And at the bottom it has an</p><p class=MsoNormal>Apache-autoindex directory listing of files. In other words, the</p><p class=MsoNormal>prepended too-much-text stuff was what Apache parsed from a .message (or</p><p class=MsoNormal>whatever it is) file. </p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Below that appears the actual Apache autoindex, which is this (edited </p><p class=MsoNormal>slightly for e-mail):</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Name Last modified Size </p><p class=MsoNormal>.. - </p><p class=MsoNormal>MD5SUMS 2016-01-24 19:06 70 </p><p class=MsoNormal>MD5SUMS.sign 2016-01-24 19:08 819 </p><p class=MsoNormal>SHA1SUMS 2016-01-24 19:06 78 </p><p class=MsoNormal>SHA1SUMS.sign 2016-01-24 19:08 819 </p><p class=MsoNormal>SHA256SUMS 2016-01-24 19:06 102 </p><p class=MsoNormal>SHA256SUMS.sign 2016-01-24 19:08 819 </p><p class=MsoNormal>SHA512SUMS 2016-01-24 19:06 166 </p><p class=MsoNormal>SHA512SUMS.sign 2016-01-24 19:08 819 </p><p class=MsoNormal>debian-8.3.0-amd64-i386-netinst.iso 2016-01-23 23:20 556M </p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>So, there you go -- an actually excessive selection of checksums, and</p><p class=MsoNormal>gpg signatures for each.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>It's annoying that one is forced to get creative and dig for those, but</p><p class=MsoNormal>at least logic, persistence, and lengthy Internet experience _can_ get</p><p class=MsoNormal>you there.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I'd say this is the sort of brain damage sadly likely when the online</p><p class=MsoNormal>culture presses to hide all possible detail: Exactly one operation </p><p class=MsoNormal>(in this case, grab the ISO) is made very easy; every other operation is</p><p class=MsoNormal>made harder because artifically invisible.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The depressing bit is: In general, Debian Project is better than</p><p class=MsoNormal>everyone else at consistently providing checksums and verifiable</p><p class=MsoNormal>signatures. And yet, the novice-friendly front-door page for the</p><p class=MsoNormal>underlying files (in this case) goes out of its way to _hide_ all of</p><p class=MsoNormal>those and present only the ISO.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have no solution, but can sit with you and admire the problem.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>_______________________________________________</p><p class=MsoNormal>conspire mailing list</p><p class=MsoNormal>conspire@linuxmafia.com</p><p class=MsoNormal>http://linuxmafia.com/mailman/listinfo/conspire</p><p class=MsoNormal><o:p> </o:p></p></div></body></html>