Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] md5 checks / possibly compromised openssh tarball

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Eric Sandall" <sandalle AT hellhound.homeip.net>
  • To: <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] md5 checks / possibly compromised openssh tarball
  • Date: Thu, 1 Aug 2002 09:32:29 -0700 (PDT)

Sergey A. Lipnevich said:
> Julian, my friend,
>
> I agree that it's a help, but where's the action here? Who's really
> concerned about sorcery having this feature? And if nobody finds out
> about xyz.tar.gz being trojaned because it's not in such a wide use, how
> will you find out? That makes things worse because it gives you just
> that: false sense of security. My apartment door is very good, steel
> frame etc., but I'm damn sure burglars if any would use balcony because
> it's not very high and has just one simple door (that's why there's no
> resaleable valuables at home). Making the door stronger in my case
> doesn't pay. But for SourceMage the perspective is to contain valuable
> data, so it has to have security which everyone can rely on.
>
> BTW, I think it would hurt to just take the checksum and apply it to
> _both_ tar and tar.gz/bz2, and see which one matches. But for nes
> spells, the checksum should be generated against tar.
>
> --Sergey.
>
> Julian v. Bock wrote:

You are paryially correct. While using MD5sums would possibly enhance the
feeling of security beyond what it actually entails, the MD5sums _will_
give some additional security if the burglars do decide to come in the
front door. :)

So, since it provides some additional security against a frontal assault I
say that we should use MD5sums (on the .tar, not the .tar.xxx). As for
the balcony, we need to find other ways to bolster those defenses, as
MD5sums (as you say) will not help keep them out other ways.

-One of Three

--
Eric Sandall | Source Mage GNU/Linux Developer
sandalle AT hellhound.homeip.net | http://www.sourcemage.org
http://hellhound.homeip.net/~sandalle | SystAdmin @ Inst. Shock Physics @ WSU
ICQ: 667348 | http://www.shock.wsu.edu/






Archive powered by MHonArc 2.6.24.

Top of Page