Should switch from md5sum to sha256sum

[bryanquigley]

md5sum isn't secure anymore (​https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities)

The protocol should be extended to support sha256 at least.

[Nicolas]

What is the attack scenario where a collision attack would break BOINC?

I think you need a preimage attack (which is still impractical even for MD5), not a collision attack.

[bryanquigley]

I don't believe there is a practical attack right now just if the md5sum is correct (over HTTPS let's say) and we're just attacking using the data downloaded file. Just best practice and it wouldn't hurt to have clients already support it when m5sum is broken worse.

The worst you might be able to do is try to brute force an app to crash and hope it breaks confinement and causes random damage. You couldn't inject meaningful code (my understanding anyway).