<story><title>OldVersion.com software downloads for old versions of programs, drivers &amp; games</title><url>http://www.oldversion.com/</url></story><parent_chain><item><author>oefrha</author><text>Broken certs:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  curl: (60) SSL: no alternative certificate subject name matches target host name &amp;#x27;assets.oldversion.s3.amazonaws.com&amp;#x27;
&lt;/code&gt;&lt;/pre&gt;
That aside, an obvious problem with binary download sites like this is that you don&amp;#x27;t know if what you&amp;#x27;re getting is malicious. Hosting arbitrary binaries isn&amp;#x27;t cheap, so the economics of sites like this almost encourages shady behavior, not to mention the possibility of malicious users.&lt;p&gt;Edit: I realize my broken certs problem must be caused by an extension (probably HTTPS Everywhere) here. Anyway, probably don&amp;#x27;t want to download binaries over unencrypted channels in 2020...</text></item></parent_chain><comment><author>oldversion</author><text>I&amp;#x27;m the founder of the site. We are ad-supported, ideally would like to be community-supported. We take the responsibility of hosting these binaries seriously, but sometimes there are bad actors in terms of users which we work to address before the binaries become available for public download.&lt;p&gt;Now looking into a potential API that could at least link with virustotal or a site like that to give users more information about each binary. Any ideas&amp;#x2F;tech solutions would be welcome.&lt;p&gt;Thanks - what an honor it is to see this passion project from 20 years ago still relevant (and would love to have it be more relevant to various communities).</text></comment>
<story><title>OldVersion.com software downloads for old versions of programs, drivers &amp; games</title><url>http://www.oldversion.com/</url></story><parent_chain><item><author>oefrha</author><text>Broken certs:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  curl: (60) SSL: no alternative certificate subject name matches target host name &amp;#x27;assets.oldversion.s3.amazonaws.com&amp;#x27;
&lt;/code&gt;&lt;/pre&gt;
That aside, an obvious problem with binary download sites like this is that you don&amp;#x27;t know if what you&amp;#x27;re getting is malicious. Hosting arbitrary binaries isn&amp;#x27;t cheap, so the economics of sites like this almost encourages shady behavior, not to mention the possibility of malicious users.&lt;p&gt;Edit: I realize my broken certs problem must be caused by an extension (probably HTTPS Everywhere) here. Anyway, probably don&amp;#x27;t want to download binaries over unencrypted channels in 2020...</text></item></parent_chain><comment><author>ehPReth</author><text>This happens for s3 buckets with dots in the names as wildcard certificates (*.s3.amazonaws.com) only cover one &amp;#x27;level&amp;#x27;.&lt;p&gt;You can manually work around it via using the alternative URL to access a bucket with a dot in the name:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  https:&amp;#x2F;&amp;#x2F;s3.amazonaws.com&amp;#x2F;assets.oldversion&amp;#x2F;&amp;lt;filepath&amp;gt;&lt;/code&gt;&lt;/pre&gt;</text></comment>