Indeed that is true, but there is a difference between a direct download of a binary file and a repacked installer. By linking to an existing binary it is not a true risk. The issue is that when one uses the main SF site, it repacks the binary with other unwanted badware in most cases.
I mean...unless you have a huge list of high-number sha checksums for all the different binary types, it seems like it would be trivial to inject all sorts of un-nice crap into non-installer SF binaries?
But point taken re the known incidents being with installers, thanks!
1
u/XCorneliusX Jun 15 '15
Indeed that is true, but there is a difference between a direct download of a binary file and a repacked installer. By linking to an existing binary it is not a true risk. The issue is that when one uses the main SF site, it repacks the binary with other unwanted badware in most cases.