Tiny Core Linux

General TC => General TC Talk => Topic started by: WellBehavedDemon on June 05, 2026, 11:00:39 AM

Title: No HTTPS site for download
Post by: WellBehavedDemon on June 05, 2026, 11:00:39 AM

There's a chance that the TinyCoreLinux project is under attack. Home routers are known to be vulnerable garbage and, when I try to download TinyCoreLinux, either the connection to "tinycorelinux.net" fails or the response is that "there is no HTTPS support" (see the image below). But this is nonsense! I can access "forum.tinycorelinux.net" without issue so why should "tinycorelinux.net" have issues? I think that the home router that I'm using (garbage provided by a garbage ISP) detects a connection to "tinycorelinux.net" and denies it or forces an HTTP connection so that  a man-in-the-middle attack where I'll end up downloading a fake ISO image happens.

(https://i.ibb.co/1fnnRVtJ/20260605-11h55m35s-grim.png) (https://ibb.co/LzPP9wXh)

Where can I find the hashes for the TinyCoreLinux CD images? I need this to make sure that I'm not downloading a version with vulnerabilities.

Title: Re: No HTTPS site for download
Post by: Juanito on June 05, 2026, 11:18:38 AM

What happens if you load the wget and ca-certificates extensions and try something like “wget repo.tinycorelinux.net/17.x/x86/tcz/flwm.tcz.md5.txt”?

Title: Re: No HTTPS site for download
Post by: gadget42 on June 05, 2026, 11:19:44 AM

one previous thread regarding the http download webpages:

https://forum.tinycorelinux.net/index.php?topic=26893.0

Title: Re: No HTTPS site for download
Post by: WellBehavedDemon on June 05, 2026, 11:28:40 AM

Quote

What happens if you load the wget and ca-certificates extensions and try something like “wget repo.tinycorelinux.net/17.x/x86/tcz/flwm.tcz.md5.txt”?

(https://i.ibb.co/HpMM1YyS/20260605-12h24m15s-grim.png) (https://ibb.co/n8VVZfyG)
(https://i.ibb.co/8ghpGrQ4/20260605-12h25m22s-grim.png) (https://ibb.co/v4tGf3Mv)

See the screenshots above. That is what happens. If I try to connect to it through HTTPS, the connection will be refused. This is odd because forum.tinycorelinux.net works without issue, but the domains where the integrity hashes and downloads are available are not served through HTTPS.

Title: Re: No HTTPS site for download
Post by: Paul_123 on June 05, 2026, 12:50:18 PM

The only part of the site running https is forum.tinycorelinux.net and wiki.tinycorelinux.net.

Everything else is hosted from the repo server that is http only.  Which would include URLs like tinycorelinux.net and repo.tinycorelinux.net