Be honest: do you check the sha256 of an image you download?

[MTSistemi]

Not a rhetorical question — we have the numbers, and they are worth talking about.

Our download statistics show the .sha256 files being fetched a tiny fraction of the
number of times the images are. Almost nobody verifies. That is not a scolding: it is a
design signal, and it is on us if the safe thing is not the easy thing.

	Option
👍	Always — I check the checksum before booting anything
❤️	Sometimes — for a fresh project or an unfamiliar mirror
🚀	Never — I trust HTTPS and get on with it
👀	I did not know I should

Why we are asking: the answer changes what is worth building. If almost nobody verifies by
hand, the useful move is to make it automatic — the torrent already carries the hashes and
checks every piece as it downloads, and we could sign the images so the installer verifies
itself and says so on screen. If people do verify, we should instead make the checksums
easier to reach than they are today.

Tell us what would actually change your habit, if anything.

---

Voting is by reaction: GitHub's API cannot create native polls, only the web interface can, and we would rather have a working poll today than a perfect one later. One reaction per option, react as many times as you like if more than one applies.

[virgiliodomingo1-svg]

I think a built-in SHA-256 checker on linux is cool. It would even be a selling point for security.