Yeah that's a sore point :-/ The downloads are served via HTTPS, though. Also, publishing the SHA1 hashes over HTTP kind of defeats the purpose, so here they are again (HackerNews is HTTPS :)):

bindiff420-debian8-amd64.deb 38fbea8070495fc8730d7c86eae03bc68fde291f bindiff420-debian8-i386.deb 49cdd6ae7ebe5b1813a5fcafaae9fde19005c824 bindiff420-win-pluginsonly.zip e2b786d405aac23aced989e02080dd69c18ab75e bindiff420-win-x86.msi 89f2eadc6582d4acca1e78db3617b5fba3eced0f bindiff-license-key.zip 95715a8bd7469106fc60b03f94f3cc87604e354c