Tiny Core Linux
General TC => General TC Talk => Topic started by: WellBehavedDemon on June 05, 2026, 11:00:39 AM
-
There's a chance that the TinyCoreLinux project is under attack. Home routers are known to be vulnerable garbage and, when I try to download TinyCoreLinux, either the connection to "tinycorelinux.net" fails or the response is that "there is no HTTPS support" (see the image below). But this is nonsense! I can access "forum.tinycorelinux.net" without issue so why should "tinycorelinux.net" have issues? I think that the home router that I'm using (garbage provided by a garbage ISP) detects a connection to "tinycorelinux.net" and denies it or forces an HTTP connection so that a man-in-the-middle attack where I'll end up downloading a fake ISO image happens.
(https://i.ibb.co/1fnnRVtJ/20260605-11h55m35s-grim.png) (https://ibb.co/LzPP9wXh)
Where can I find the hashes for the TinyCoreLinux CD images? I need this to make sure that I'm not downloading a version with vulnerabilities.
-
What happens if you load the wget and ca-certificates extensions and try something like “wget repo.tinycorelinux.net/17.x/x86/tcz/flwm.tcz.md5.txt”?
-
one previous thread regarding the http download webpages:
https://forum.tinycorelinux.net/index.php?topic=26893.0
-
What happens if you load the wget and ca-certificates extensions and try something like “wget repo.tinycorelinux.net/17.x/x86/tcz/flwm.tcz.md5.txt”?
(https://i.ibb.co/HpMM1YyS/20260605-12h24m15s-grim.png) (https://ibb.co/n8VVZfyG)
(https://i.ibb.co/8ghpGrQ4/20260605-12h25m22s-grim.png) (https://ibb.co/v4tGf3Mv)
See the screenshots above. That is what happens. If I try to connect to it through HTTPS, the connection will be refused. This is odd because forum.tinycorelinux.net works without issue, but the domains where the integrity hashes and downloads are available are not served through HTTPS.
-
The only part of the site running https is forum.tinycorelinux.net and wiki.tinycorelinux.net.
Everything else is hosted from the repo server that is http only. Which would include URLs like tinycorelinux.net and repo.tinycorelinux.net
-
Where can I find the hashes ...
perhaps see also
"package distribution by bittorrent" @ https://forum.tinycorelinux.net/index.php?topic=13373.msg167841#msg167841
on a bit of a tangent from tc distro iso
..but still perhaps of interest wrt https
"how to apps mirror support https?" @ https://forum.tinycorelinux.net/index.php?topic=27730.msg181090#msg181090
the wiki page about mirrors mentions archive . org has copy's of iso
https://wiki.tinycorelinux.net/doku.php?id=wiki:mirrors&s[]=mirror
and afair they offer both # and torrent download option ...
also ftr fwiw/ last time i checked some mirrors
do support https and other protocols..
-
(see the image below)
do i *really* want that in "my" gpu (https://forum.tinycorelinux.net/index.php?topic=26867.0) mem pipeline?
sounds like another "bad" vector
::) see also tompson , godel
There's a chance that $N is under attack.
those who pre-configure
everyone's browser defaults (to https)
seam like a more likely cause
but dont take my word for it
ask the "built-in" / updated "ML" that they included in latest auto-update to most 'commercially sponsored browsers'
... though im shore the TOS will say that it's only for the sake of entertainment
eg: https://hackaday.com/2026/04/01/ask-hackaday-using-copilot-are-you-entertained/
of course! ???
-
If you don't want to disable HTTPS-only mode in your browser, use one of the mirrors (https://wiki.tinycorelinux.net/doku.php?id=wiki:mirrors) with HTTPS support, such as:
https://mirrors.dotsrc.org/tinycorelinux/
-
If you don't want to disable HTTPS-only mode in your browser, use one of the mirrors (https://wiki.tinycorelinux.net/doku.php?id=wiki:mirrors) with HTTPS support, such as:
https://mirrors.dotsrc.org/tinycorelinux/
And if you want the https mirror to be supported in your actual usage, then there is a https-mirrors.tcz extension I made that will add the https versions of the mirrors to the list from mirrors.tcz (as well as backport https support into 16.x). (Available for 16.x and 17.x under both arm and x86)
And then after doing that (or adding the mirror to /opt/localmirrors) you will be able to select the mirror using tcemirror.sh .
(If you use the https-mirrors.tcz extension, it will also force loading the ca-certificates and openssl extensions, which are required for that)