On: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

[smt88]

The distribution system you're describing exists and has been in use for decades. You just distribute the build using bittorrent.

[cluckindan → smt88]

And if someone invests in having >90% of the peers offer a malicious file and serve DHTs matching that file?

[smt88 → cluckindan]

Torrent files are hashed, so it's exactly the same risk profile as the comment I was referring to. But generally hashing algorithms are collision-proof enough that what you're describing is basically impossible (requiring many years of compute time).

[pabs3 → smt88]

IIRC BitTorrent still uses SHA-1, which is becoming more problematic.

[vhcr → pabs3]

BitTorrent v2 uses SHA-256, but in any case SHA-1 is still second-preimage resistant. And the BitTorrent piece hashes are included in the .torrent file, so you would need to find a double collision.