Xubuntu's site serving a crypto clipper is a critical reminder: A SHA256 hash is useless when the server is compromised.
Attackers change the hash, too. You MUST verify the GPG signature.
Here's how to do it right:
https://expatriotic.me/verifying-software
#DontTrustVerify #OpSec #GPG #Xubuntu
Expatriotic
npub138…akdee
2025-10-19 16:02:40 UTC
Author Public Key
npub138xw4ym33jw06g0u2mesxlmgj2esgecrpwnlrcy9v503hh6wqzmscakdeeSeen on
wss://nostr.momPublished at
2025-10-19 16:02:40 UTCEvent JSON
{
"id": "0abe633f6b6c58e62ab6909f9f94e7c9c7d26cda7f3bcf898753aa6ea80149d2",
"pubkey": "89ccea93718c9cfd21fc56f3037f6892b30467030ba7f1e085651f1bdf4e00b7",
"created_at": 1760889760,
"kind": 1,
"tags": [
[
"alt",
"A short note: Xubuntu's site serving a crypto clipper is a criti..."
],
[
"t",
"DontTrustVerify"
],
[
"t",
"donttrustverify"
],
[
"t",
"OpSec"
],
[
"t",
"opsec"
],
[
"t",
"GPG"
],
[
"t",
"gpg"
],
[
"t",
"Xubuntu"
],
[
"t",
"xubuntu"
],
[
"r",
"https://expatriotic.me/verifying-software"
]
],
"content": "Xubuntu's site serving a crypto clipper is a critical reminder: A SHA256 hash is useless when the server is compromised. \nAttackers change the hash, too. You MUST verify the GPG signature.\nHere's how to do it right: \nhttps://expatriotic.me/verifying-software\n#DontTrustVerify #OpSec #GPG #Xubuntu",
"sig": "683e90f4b58a43d1b0f5926e810f7f6abae24535e533e8571aa24f441907522ef6fd6922632938020b0b8a37ff8fe60a6a02fabc31a284c7ac247be73137e25a"
}