<p>github also doesn't support https downloads. though the download 'area' is https, the actual files are pulled from <a href="http://cloud.github.com" rel="nofollow">http://cloud.github.com</a></p>

<p>you really are barking up the wrong tree with the https bit, since all https is telling you is that the server you're talking with is who it claims it is. if server is compromised, it will serve you a trojaned file just as happily as any other file.</p>

<p>what you really want to do is verify the pgp signature of the file (or of a file containing a hash of the released file), made by the developer making the release. you can do this regardless of where you download the files - both github and sourceforge contain the gpg-signed sha1sums file that you can verify the signature of to ensure file integrity and authenticity. the only way that could be compromised if the developer's machine itself was compromised.</p>

CC BY-SA 3.0
2011-10-02T22:20:35.310Z
2011-10-02T22:20:35.310Z
nanotube
<p>As to why, here's a <a href="https://bitcointalk.org/index.php?topic=43442.0" rel="nofollow">recent comment from Gavin Andresen</a>:</p>

<blockquote>
  <p>I'd like to switch from sourceforge to github for binary release
  downloads, because sourceforge doesn't support https for downloads.</p>
</blockquote>

<p>So, most likely we'll have HTTPS downloads soon.</p>

CC BY-SA 3.0
2011-10-02T22:21:42.110Z
see my answer below. github downloads are not https either - and the whole https bit is beside the point, anyway (imo).
nanotube
CC BY-SA 3.0
2011-10-02T19:39:55.010Z
2011-10-02T19:48:55.777Z
2011-10-02T19:48:55.777Z
D.H.
<p>The Bitcoin client is downloaded from a non-HTTPS server, so you cannot verify that it is legit, and the installer exe is not digitally signed. How often does that result in a Trojan client, and why is it done in this way?</p>

<p>I understand that you should check the pgp signature of the file, but if you do not have https, then how do you know the pgp signature is not just as bogus as the file itself? Don't we need https too?</p>

CC BY-SA 3.0
2011-10-03T03:28:35.820Z
See [How can one download the Bitcoin client securely?](http://bitcoin.stackexchange.com/questions/565/how-can-one-download-the-bitcoin-client-securely)
David Schwartz
<client><security>
Trojan Clients?
peterteach
# Trojan Clients?

(Asked by: username_0 on 2011-10-02)

The Bitcoin client is downloaded from a non-HTTPS server, so you cannot verify that it is legit, and the installer exe is not digitally signed. How often does that result in a Trojan client, and why is it done in this way?

I understand that you should check the pgp signature of the file, but if you do not have https, then how do you know the pgp signature is not just as bogus as the file itself? Don't we need https too?

**Tags:** client, security

> **Comments:**
> **username_1**: See [How can one download the Bitcoin client securely?](http://bitcoin.stackexchange.com/questions/565/how-can-one-download-the-bitcoin-client-securely)  

---

## 2 answers

### Answer by username_2 on 2011-10-02. Score: 8

github also doesn't support https downloads. though the download 'area' is https, the actual files are pulled from <http://cloud.github.com>

you really are barking up the wrong tree with the https bit, since all https is telling you is that the server you're talking with is who it claims it is. if server is compromised, it will serve you a trojaned file just as happily as any other file.

what you really want to do is verify the pgp signature of the file (or of a file containing a hash of the released file), made by the developer making the release. you can do this regardless of where you download the files - both github and sourceforge contain the gpg-signed sha1sums file that you can verify the signature of to ensure file integrity and authenticity. the only way that could be compromised if the developer's machine itself was compromised.


---

### Answer by username_3 on 2011-10-02. Score: 3

As to why, here's a [recent comment from Gavin Andresen](https://bitcointalk.org/index.php?topic=43442.0):

> I'd like to switch from sourceforge to github for binary release
> downloads, because sourceforge doesn't support https for downloads.

So, most likely we'll have HTTPS downloads soon.

> **Comments:**
> **username_2**: see my answer below. github downloads are not https either - and the whole https bit is beside the point, anyway (imo).  

---

