Comment by theden

IMO checksums more or less offer a false sense of security for users if they're stored/shared on the same page/domain as the download, since it'd be trivial for a bad actor to change them if the files are compromised.

Linux mint, for example, the attacker updated the checksums for the ISOs on the page when it was compromised https://www.infoworld.com/article/3036178/lesson-from-linux-...

I don't really have a solid solution to this, besides searching the checksum on google to see if it's listed anywhere else as a soft 3rd party check