Safe installs
Installing a program gives it the same power over your files as you have. This lesson shows how to make sure what you install is the genuine program, unchanged, from the people who made it, and how to keep it that way with updates.
Start at the official source
Most malware arrives because someone installed it themselves: a cracked app, a fake download button, an APK shared in a chat. The first and biggest defence is where you get software:
| Source | Why it is safer |
|---|---|
Your system's package manager (apt, dnf, Snap, Flatpak) | Packages are checked against the repository's signing key automatically |
| An app store (Microsoft Store, Google Play, Chrome Web Store, Firefox Add-ons) | The store reviews and signs what it distributes, and updates it |
| The project's own releases page | You get the file straight from the people who made it |
Get the address of the releases page from the project's own website or repository, not from an ad or a search result's sponsored link. For Dhiva Labs apps, every install page links to the right place, and Installing apps lists every channel.
Checksums: did the file arrive unchanged?
A checksum (or hash) is a short fingerprint calculated from every byte of a file. Change one byte and the checksum changes completely. Many projects publish a SHA-256 checksum next to each download, either in a .sha256 file or a SHA256SUMS file.
A checksum file is one line per file: the hash, two spaces, the file name.
86ffabe91d4a0f1811056a5cb95d99f4d506e4355047dad9c3caef8fef55c7c1 example-app_1.2.0_amd64.debPut the download and its checksum file in the same folder, then let sha256sum compare them:
sha256sum -c example-app_1.2.0_amd64.deb.sha256example-app_1.2.0_amd64.deb: OKOK means the file matches the published checksum. If even one byte differs:
example-app_1.2.0_amd64.deb: FAILED
sha256sum: WARNING: 1 computed checksum did NOT matchDo not install a file that fails. Delete it and download it again from the official page. If it fails again, tell the project.
Two variations you will meet:
# A SHA256SUMS file lists every file in the release; check only the ones you downloaded
sha256sum -c --ignore-missing SHA256SUMS
# The checksum is printed on a web page instead of in a file
echo "86ffabe91d4a…55c7c1 example-app_1.2.0_amd64.deb" | sha256sum -c -In the second command, paste the full 64-character hash in place of the shortened one. On Windows, PowerShell's Get-FileHash prints a file's SHA-256 for you to compare by eye; on macOS, use shasum -a 256.
What a checksum proves, and what it does not
A checksum proves the file is the same as the one the checksum was made from. It catches a broken download, and a file swapped on a mirror. It does not prove who made the file: if an attacker controls the download page, they can replace the file and the checksum together.
Signatures: who made it?
A digital signature goes further. The publisher signs the file, or its checksum list, with a private key only they hold. Anyone can check the signature with the publisher's public key. A valid signature proves both that the file is unchanged and that it came from the holder of that key.
PUBLISHER YOU
file ──► sign with private key ──► file + signature
│
▼
check with publisher's public key
│
valid ──► unchanged, and from them
invalid ─► do not installYou use signatures every day without noticing:
- Package managers check every package's signature before installing it.
- Windows shows the verified publisher's name in the "Do you want to allow this app to make changes" prompt for a signed program, and "Unknown publisher" for an unsigned one.
- Android refuses to install an update unless it is signed with the same key as the app already installed.
Some projects also publish a signature file (often .sig or .asc) for manual checking with a tool such as GnuPG. That is only as good as your copy of the public key, so get it from the project's official site.
SmartScreen and "unknown" apps on Windows
Microsoft Defender SmartScreen checks downloaded programs against a reputation list. For a program it has not seen often, it shows "Windows protected your PC". That is not proof of malware: new or small projects often trigger it. It is a prompt to stop and check:
- Did the file come from the project's own releases page?
- Does the checksum match, if one is published?
- Did you expect this program, and do you know what it is?
If all three are yes, you can choose to run it. If you are unsure, do not. Never turn SmartScreen or your antivirus off to make an installer work.
Sideloaded APKs on Android
Sideloading means installing an Android app from a file instead of from an app store. Android allows it per source: the first time, it asks whether your browser or file manager may install unknown apps.
- Download APKs only from the app's own releases page.
- Allow installing for that one install, then turn the permission off again in Android settings.
- An APK installed this way does not update itself. Check the releases page for updates.
- Be wary of any APK sent to you in a message, especially one that asks for accessibility, SMS or device admin access after installing.
The Android track covers permissions and sideloading in more depth.
Keep it updated
Most attacks use known weaknesses that already have a fix. An update is often a security fix.
- Turn on automatic updates for your operating system, browser and phone.
- On Ubuntu and Debian,
sudo apt update && sudo apt upgradeinstalls available updates; Snap packages update themselves. - Restart when asked: many updates only take effect after a restart.
- Remove software you no longer use. It cannot be exploited if it is not there.
Stay safe
- Official source first. A checksum check second. A signature check when the project offers one.
- A failed checksum means stop, not "try installing anyway".
- Never disable SmartScreen, antivirus or Android's install checks to get a program running.
- Run installers only when you know what they are. A script piped from the internet straight into a shell runs with your permissions; read it first.
Check yourself
Question 1 of 6
You run this after downloading an installer. What does the output mean?
$ sha256sum -c example-app_1.2.0_amd64.deb.sha256
example-app_1.2.0_amd64.deb: FAILED
sha256sum: WARNING: 1 computed checksum did NOT matchWhat you learned
- Where you get software is the biggest defence: package manager, app store, or the project's own releases page.
sha256sum -cproves a file is unchanged; a signature also proves who made it.- SmartScreen and "unknown publisher" warnings mean "check first", not "malware".
- Sideload APKs only from the official source, and keep everything updated.