Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Ladislav Hagara <ladislav.hagara AT unob.cz>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
  • Date: Wed, 31 Aug 2005 18:51:56 +0200

The beauty of hashes is that they don't need any extra support in addition to
what's in sorcery now.


Moreover, if there is some integrity problem, even users can discuss about their hashes, they can easily compare them.
In p4 reviews I see ascii changes, not only "binary file was changed".

Vendor signing is great but personally I would extra add our hash.
What about if for example home page of wget is cracked, wget author's key is stolen, new tarball with "rm -rf /*" is created and signed?

--
Got yourself a ledger.sourcemage.org account?
http://ledger.sourcemage.org/

Ladislav Hagara
Source Mage GNU/Linux Developer
http://www.sourcemage.org/







Archive powered by MHonArc 2.6.24.

Top of Page