 Permalink for comment 202851 RE[3]: Great article, but... by
Tom5 on Wed 17th Jan 2007 21:33 UTC in reply to "RE[2]: Great
article, but..." Member since:  Why can't the directory name be
the program name (as opposed to the URL)--i.e. gimp-2.3-- so it
can be installed off of CD? I don't understand what about making
the folder a hash makes it more secure than, say, storing the
hash information in a separate protected file within the
program's folder.  OK, so Alice puts a CD in the drive with
'gimp-2.3.tgz' on it. How can the system know that it's genuine?
Anyone could make such a CD. The system can't tell, so it can't
share it with Bob.  But, if the CD contains an archive called
'sha256=XYZ.tgz', then it can be put in the shared directory.
The system can see that it's correct just by comparing the
archive's contents to its name.  Reply Parent Score: 1