Comment Re:Hashes not useful (Score 1) 324
Seagate is correct. Putting a hash on the website doesn't improve security at all because anyone who can change the download can also change the web page containing the hash.
Perhaps, but the change would be kind of visible. It would be trivially easy to require concurrent events to be associated with the key change, e.g. have an SVP send an email stating, 'I confirm the new hash key is $FOO' to half a dozen senior technical employees. The odds of all of them being compromised is vanishingly small.
A tool to verify the firmware is poetically impossible to write.
Writing phonetically for meter:
foreach dollar testkey in foo{
while input is not empty { do {
test result equals (hash lookup in sequel)
}}
if (test result's good) return true;
