Further, there are hundreds of interesting and useful programs available by download from shareware and freeware repositories, often downloaded and virtually never independently checked for security concerns. Yet, we fear the loss of our data in the extreme while ignoring the integrity of our computer platforms. Microsoft delivers digitally signed downloads from their support and Windows Update web sites. Anyone can and should do the same to ensure their software deliveries via 3rd party websites do not become infected. Unfortunately, this currently only signs .exe , .cab , .ocx , and .class files.
Integrity is verified when the file is downloaded by a suitable browser.
No major company would actually be that anti-customer in any other field. It clearly is time for more of a legal commitment from our software vendors. I hope we don't have to lobby congress in order to make this happen. The Open Source movement argues that their software is inherently more trustworthy because it is open to public inspection. I grant that the source is open, but unless a method is developed to verify that a given binary module is derived from the public sources, there can be no trustworthy binary distributions.