In our "[trustless](https://lisk.io/academy/blockchain-basics/benefits-of-blockchain/why-is-blockchain-trustless)" world, I am writing a post this morning on what I have learned to do to add an additional layer of security to my downloading and installation of software.  Particularly open-source software, which we encounter a __*lot*__ of when choosing to invest in blockchain technology and the resulting "digital asset" class.

<p><center><img src="https://cdn.pixabay.com/photo/2019/02/28/20/28/security-4026783_960_720.jpg"><sub><a href="https://pixabay.com/photos/security-man-monitor-binary-4026783/" target="_blank">Image Source: Pixabay</a></sub></center></p>

As an older man, with a lot of experience in life, I have always enjoyed a good quote.  The older I get, the more I like them ...  &#128522;

Here is one which might be applied to our topic this morning:

> *"__Eternal vigilance__ is the price of liberty"*
>
> [Source: This Day in Quotes](http://www.thisdayinquotes.com/2011/01/eternal-vigilance-is-price-of-liberty.html)

So ... Let's talk about being prudent in taking some pretty simple steps to add some protection to our use of downloaded open-source software.
<p><center><img src="https://steemitimages.com/DQmc2H3Lgvc1aWLMBBeokhh3AkjrLpjDqsB49SqVYB7nXAy"></center></p>

<h1>Checking Validity of Downloaded Software</h1>

While making no claim to being a "technical wizard" when it comes to this topic, I am well enough aware of the potential for __*any*__ software to be a potential threat to my home network, that I take the following steps, when downloading and installing open-source software.

* Note:  When downloading from large corporations, e.g. Microsoft, Apple, Google, etc., we typically don't even think about this, as we assume our protection is "built in" to their services to us.  Hopefully right, but not the topic of this post.<br><br>  This post is specifically about software accessible through open-source channels, e.g. "digital asset" wallets, as in the example which follows:<br><br>

Yesterday, I wrote an [update post](https://steemit.com/blog/@roleerob/update-2019-mar-20-what-s-up-with-roleerob) in which I mentioned @arkecosystem and learning about the latest  [ARK](https://ark.io/) wallet, for a digital asset in which I have chosen to invest.

Well, this morning I was following up and getting this installed, as I like to stay on top of ensuring I have the "latest, greatest" version of any software I use.  Here are the steps I followed, which will provide you an outline for what I always do, no matter what the specific software may be.<br><br>

*  Step __1__:  Opened the link I maintain in a database, to the [GitHub repositiory](https://github.com/ArkEcosystem/desktop-wallet/releases) for the ArkEcosystem's software, and downloaded into the subfolder on my computer where I store ARK wallet sofware.<br><br>Note:  If you are not already familiar with it, [GitHub](https://github.com/) is the largest repository in the world for software code writers.  If you choose, you can open an account there easily, so you can communicate with them.<br><br>

<p><center><img src="https://steemitimages.com/800x0/https://cdn.steemitimages.com/DQme9mhUJNLorcXs54MNiF929Ls87wfkboUt5B8LrfvQmxg/image.png"></center></p><p><center><h6>Image 1: Click on Software Link and Download</h6></center></p>

*  Step __2__:  Opened the ReadMe file stored in the subfolder into which the file above was downloaded, and updated it with information from this latest download, as shown below.<br><br>

<p><center><img src="https://cdn.steemitimages.com/DQmUBEza6fQ2QqEedUMzkP6apfeYem44GiwHq9dHtqDtfxP/image.png"></center></p><p><center><h6>Image 2: Update CertUtil Specs in ReadMe.txt File</h6></center></p>

*  Step __3__:  In the subfolder storing the downloaded file, hold down the Shift key the right click with your mouse, anywhere on the screen.  This opens an instance of Windows PowerShell, as shown below.  Copy and paste the CertUtil string stored in the ReadMe file into PowerShell and execute.<br><br>Note:  If you are not already familiar with it, CertUtil is a Windows utility which has a number of uses ...<br><br>

<p><center><img src="https://cdn.steemitimages.com/DQmSRndd3VYUknMvdFKpzypZ3ifJMBvUcxARruyi5RmXpeQ/image.png"></center></p><p><center><h6>Image 3: Execute CertUtil Command in Windows PowerShell</h6></center></p>

*  Step __4__:  Copy and paste the SHA256 hash generated in Step 3 into a spreadsheet designed to compare this string, with the one provided on the webpage from which the software was originally downloaded.  See Image 1 above.<br><br>Note:  Sadly, not all web sites provide the hash info needed.  I have myself written to the software authors, when I have found this valuable info missing, and have been generally pleased at their responsive in providing it for future releases.<br><br>

<p><center><img src="https://steemitimages.com/600x0/https://cdn.steemitimages.com/DQmVNgLLCbmAKfEaZ62mAEfH96nGacgsZeYqibMetVZTmQA/image.png"></center></p><p><center><h6>Image 4: Compare SHA256 Hashes in Spreadsheet</h6></center></p>

As most of us have already experienced, the cryptographic strings found in this new "digital asset" class universe are bewilderingly complex.  Rather than take the time and trouble, all while risking the chance of error, to compare them *manually,* I built a spreadsheet to "automate" the process.

The spreadsheet shown above is comparatively simple.  The key is the formula shown in the B10 cell.  It strips any leading or trailing "white space" and compares the two strings - one from the PowerShell command and one from the website.  The formula returns TRUE if the strings match.  FALSE if they don't.

So ...  What just happened?! &#128521;

The SHA256 hash value is a sophisticated store of a number representing the file you just downloaded.  By comparing it to the value generated by a *copy* of the software now downloaded on to __*your*__ computer, you are checking to ensure that you are not working with a tampered version of the file.

Hackers and those with nothing better to do with their lives than cause us trouble can be __*very*__ sneaky in what they can embed in these files.  Unbeknownst to you.  The SHA256 hash value is one common way of testing for this.

Disclaimer:  While not __*bulletproof*__, these steps provide just what this post says - "added security."  For just a bit more peace of mind ... 

---
So ... Safe to install the newly downloaded sofware now right?  Yeah ...  Well no ...  Not entirely ...

*  Step __5__:  You may, as I commonly have, experience the following dialog, when you begin to install your newly downloaded software.  If you want to proceed, this illustration shows you how to do it - click on the "More Info" hyperlink, then on the "Run anyway" button.<br><br>Note:  Again, far from an expert, but my understanding is Windows Defender (if you have it activated, as I do ...)  is checking to see if there is a Microsoft certificate for the software publisher on file in their security systems.<br><br>

<p><center><img src="https://cdn.steemitimages.com/DQmPmwuiqGmxD7WLQd91pSw8PexubxreYi4pWHuiWzUoNWa/image.png"><img src="https://cdn.steemitimages.com/DQmRxiSWYpiwKCxfegq4vEsWMUJJaer1UpQWFcugjm8XsZk/image.png"></center></p><p><center><h6>Image 5: Getting Past Windows Security Check?</h6></center></p>

While this may initially be alarming, keep in mind that many, many code writers in the open-source community produce what they do in their "off hours," when they are not working at their "day jobs."   Many elect, for various reasons __*not*__ to take the time to register for these certificates.  Perhaps as a philosophical "statement," perhaps due to a lack of time, etc.

After researching this issue and reading up on what it represents, I have always done what I show above and, so far, have not lived to regret it.  You will have to decide for yourself whether this is a risk worth taking.

---

These are the steps I successfully followed a short time ago.  Along with taking the time to capture the screenshots above for this post.<br><br>

<p><center><img src="https://cdn.pixabay.com/photo/2018/05/04/17/16/eye-3374462_960_720.jpg"><sub><a href="https://pixabay.com/photos/eye-information-technology-digital-3374462/" target="_blank">Image Source:  Pixabay</a></sub></center></p>

Wrapping up, while never a fan of being paranoid, I have long been an advocate for being __*prudent.*__  Keeping at least "one eye" on your digital security is highly recommended.

I hope this will be of some help to you dear reader. 

<p><center><img src="https://steemitimages.com/DQmc2H3Lgvc1aWLMBBeokhh3AkjrLpjDqsB49SqVYB7nXAy"></center></p>

<h1>Closing</h1>

Just this morning, I was writing to my good Steemian friend, @insight-out, about writing whatever is on your heart. "Practicing what I preach" I have long written on a number of topics on the Steem blockchain.  And organized them into what I typically refer to as "series."

So ...  Here you have my latest contribution to my "technical aide" series.  I’d love to hear any feedback you may be inspired to provide.

Until "next time," all the best to you for an even better tomorrow, as we all __*work*__ together to build our Steem Community!  &#128077; &#128522;

Respectfully, 
Steemian @roleerob 

Posted using [SteemPeak](https://steempeak.com) and *“immutably enshrined in the blockchain”* on Thursday, 21 March 2019!

---

P.S.  If anyone reading this would have any tips for me on better tags / channels to use for posts like this one, I would be very appreciative of any help provided!

<p><center><img src="https://steemitimages.com/600x0/https://steemitimages.com/DQmZUZfsi6RST4zM3NrERtKZv12uwXMLoWsbvVgpKRyGP6D/divider%20123.png" alt="divider 123.png" /></center></p>

<p><center><img src="https://steemitimages.com/400x0/https://ipfs.busy.org/ipfs/QmYXFnWDwR9CjHCM88xek45LeJqxT18pkVqWH7YgZZPB3d"></center></p>

<br>
##### Interested to read more of my “technical aide” posts?  Great!<br><br>
*  [Welcome to the Steemisphere! Getting Off to a "Flying Start," Version 1.0](https://steempeak.com/steem/@roleerob/welcome-to-the-steemisphere-getting-off-to-a-flying-start-version-1-0) – Covers the full spectrum of what a new Steemian needs to know to get off to a “flying start.”<br><br>
*  [User's Guide to the Steemisphere, Version 1.0](https://steempeak.com/steem/@roleerob/user-s-guide-to-the-steemisphere-version-1-0) – Covers the recommended apps and tools a new Steemian needs as they begin to engage with our Steem blockchain.<br><br>
*  [Tech Aide: Investing in the Steem Blockchain on Binance and Bittrex](https://steemit.com/steem/@roleerob/tech-aide-investing-in-the-steem-blockchain-on-binance-and-bittrex) - Covers investing in STEEM and SBD on these popular exchanges.<br><br>

<p><center><sub>This account is protected by @dustsweeper</sub></center></p>