Please enable HTTPS for downloads

[jared]

I submitted this security vulnerability to secalert_us@… but they feel it is mitigated by the existing practice of securely publishing checksums, and asked me to publish the vulnerability here.

As most users will not go through the trouble of manually verifying a checksum, please enable HTTPS for downloads.

This was suggested almost two years ago in https://www.virtualbox.org/ticket/13318 but this vulnerability still exists.

[jared]

Oh, and thanks for all the great work that goes into VirtualBox, it's a great project!

[Frank Mehnert]

Just to clarify: Not providing a HTTPS download service is NOT a security vulnerability. No doubt that a HTTPS service is convenient and automatically protects the user from man-in-the-middle attacks. But as written above, there are hashes available.