Windows – Enable MD5 or SHA1 hash functions in IIS

hashutils and HashCheck are the best packages I've found on Windows so far. Both tools are open source from the same author, but HashCheck is a shell extension and hashutils is a set of CLI tools. In my testing, they're significantly faster than the ported unxutils versions. (Despite the expectation that they'd be I/O bound.)

I also think that these tools are better than the often-mentioned HashTab, and if I could get to the Ars OpenForum, I'd link a post I wrote up with my justification.

You're almost completely right. The only correction is that they are hashes of the whole file.

Sometimes, files can be corrupted during download whatever way is used to transfer them. Hashes are there to make sure that the file is intact. This is especially useful to users with bad Internet connections. Back when I was using fax modem, I'd often get problems with corrupt downloads.

Some download managers (like GetRight, if I remember correctly), can even automatically calculate the hash of the file and compare it to known value.

Another interesting point is security. A potential problem with open source tools is how much you can trust the distributer. Often programs such as Eclipse are the main tool used by software companies and therefore it is extremely important for them to move from the developer to the user intact. Since programs are open source, it is possible to for example make infected version which would look normal, but leak source code to some remote server or infect programs made by the software with a virus (I think this actually happened to some version of Delphi) or something similar. For that reason, it is important to have official correct hash which can be used to check if the distributed file is what is claims to be.

Some thoughts about distribution channels. Often free software can be found on large amount of sites and most popular sites like SourceForge, for example have large number of mirrors. Let's say there's a server in Barland which mirrors a large software distribution site. FooSoft uses the program distributed by site and they are in Republic of Baz which is right next to Barland. If someone wanted to infiltrate FooSoft, he could modify just the copy at Barland mirror and hope that geolocation software would then make sure that FooSoft gets the modified versions. Since versions from other mirrors are fine, chances are lower that malware would be detected. You could also make malware detect computer's IP address and activate only if it's from a certain range, and that way lower chances of discovery and so on.