Quote from: gizmobuddy on December 31, 2018, 07:50:11 AM

^ This. Exactly.

At the very least, hashes should be posted on the website or the release.txt
How hard is it? I dont think it will take more then 5 minutes.

It's very easy, but would the developer chose easy way and open additional attack vector which could risk user's funds?

Quote from: pooya87 on January 01, 2019, 04:22:16 AM

Quote from: Abdussamad on December 31, 2018, 09:40:21 AM

Hashes are worthless because even fake sites can host hashes. Also if the official site gets hacked the hacker can replace the hashes too. This has actually happened in the past in the opensource world with linux mint. A digital signature can't be forged though so that's why digital signatures are provided.

i think the confusion stems from the fact that linux distributions such as Ubuntu provide a hash (SHA1, MD5, and SHA256 has) of the .iso file but what people miss is that they are also signing the hashes with a PGP key which you have to verify.
i believe they are doing it that way because it may not be possible to sign a 1-2 GB file (the .iso) with a PGP. so they provide hashes the sign them with their key.

It's fully possible to sign (even encrypt) big files, but the problem is it's resource intensive, so user with low-end PC might have problem.