Keep it clean
If you believe that a wish duplicates another one or is not meant for the category, use Options button above to report a duplicate or spam.
Add your wish
If there is an item you wish to have on GOG.com and it’s not yet on the wishlist, please add your wish
Add a public list of hashes for all game files and installers
Added by
iliketothink The most obvious reason to have a public list of hashes is to ensure downloads aren't corrupted. One easy way to do this is to post the hash for each game in a public list. Users can then compute their own hashes and check it against the list after each download to make sure their files haven't been corrupted.
Some might point out that game installers check the integrity of their contents, but this isn't true of manuals, wallpapers, soundtracks, and any other content that might be included with a game. The checker built into the game could also be corrupted, since it is part of the downloaded file. Letting the user use their own third-party checker would be a more reliable way to guarantee the file is free of corruption.
But why a public list? It has been suggested before that the hash should be shown to just the user: www.gog.com/wishlist/site/add_hashes_to_the_files
This would alleviate the problem of file corruption, but not of malicious and intentional corruption of the files. A hacker could tamper with the file while it is in transit, planting malware and disabling the checker built into the game installer, and the player would have no way of knowing this.
If the player lives in a dictatorial regime, this is especially cause for concern. Perhaps Gog is forced by a court order or a government agency to plant malware into the game files to infect the player's machine. Or maybe they bypass Gog altogether and do it without Gog's knowledge.
One way to know your file hasn't been tampered with is if a known hash matches one computed from the file you downloaded. This is why the list should be public. If it is tampered with, players will notice.
Quite a few players have needed hashes for their games. Here are just a few examples:
www.gog.com/forum/planescape_torment/correct_md5_hash
www.gog.com/wishlist/site/my_account_provide_checksums_eg_md5_sha1_etc_for_downloadable_files
www.gog.com/forum/temple_of_elemental_evil/hash_and_other_campaigns
Please add this feature for the protection of your players.
Beregorn I don't see it happening, since the first and most prominent use would be people that downloaded pirated copies of GOG games wishing to check whether it is just the game, or the pirates added something of their own
African_wildlife I cautiously support publicly displayed hash algorithms as people could verify GOG games and extras downloaded from elsewhere, but hashes should at least be displayed for owners of a game.
2 comments about this wish