How to be sure to have downloaded untampered files?

[maro]

This looks great! How can I add this to the context menu?

Installation Guide/Assistant

I have some further suggestions for the download page. Among the many distributions, Ubuntu MATE's download page is already one of the best. But there are two distros which offer even more intuitive instructions for new users: elementary OS and Tails. Tails offers an Installation Assistant which makes it incredibly easy to get started. And elementary OS allows to select the current operating system to "view tailored installation instructions."

And in elementary OS:

Verification

I also feel that the download verification instructions should be made more visible. Currently the link How to verify downloads can almost be overlooked, especially for those who download via torrent. Even in case of a torrent download, I think it is important to perform an additional verification. Is there any way to make the verification process an important part of such a multi-step installation guide/assistant? I would definitely prefer that to the current design which seems to suggest that verification is something optional (and rather troublesome). Let's make it as easy and natural as possible!

Https and Ubuntu MATE site fingerprinting

I still think the files should be served via https because - let's face it - Ubuntu is the linux distro most entry-level linux users (such as myself) choose, many of them not being very tech-savvy, security-minded and willing to bother with verifying ISO images the right way (verifying a signature with trusted keys). They shouldn't be left vulnerable to hackers sitting between the download servers and themselves. But I shall take that up with the guys at ubuntu.com.

Has someone talked to Ubuntu regarding this problem and will they change to https? Thanks for starting this thread @nizwiz. Do you have any updates?

Https alone does not guarantee that the page you are on is actually the page you intend to see. To be sure, you can check the SHA1 fingerprint in the Ubuntu MATE website certificate and compare it to a custom site fingerprint through Gibson Research Corporation's Fingerprint Service. Could the site fingerprinting be added to the download page as well?

[lah7]

I personally wouldn’t want to see a “assistant” page, it just gets in the way when many users just want to acquire a download as simple as 1-2-3. There could be a “Getting Started” tailored to each operating system, and could be written as a topic here in the community (or as a new page).

---

Currently the link How to verify downloads can almost be overlooked, especially for those who download via torrent.

As mentioned previously in this topic, torrents verify it’s integrity as it downloads… so additional verification is optional. Even if you didn’t trust the origin of the .torrent file, the magnet link is embedded into the (securely transmitted) page, so there’s two ways to be sure it’s the exact same torrent and content.

Downloading over HTTP is where verification is important. All the user needs is to securely download (and verify its signature if desired) containing the hashes so the user can check.

---

Has someone talked to Ubuntu regarding this problem and will they change to https?
… Could the site fingerprinting be added to the download page as well?

That goes beyond my abilites, that would be something for @Wimpy to ask Canonical to offer the downloads via HTTPS.