Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Andrew <afrayedknot AT thefrayedknot.armory.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
  • Date: Wed, 31 Aug 2005 16:00:02 -0700

On Wed, Aug 31, 2005 at 06:43:24PM -0400, Sergey A. Lipnevich wrote:
> On Wed, 2005-08-31 at 09:51 -0700, Andrew wrote:
> > >
> > > Vendor signing is great but personally I would extra add our hash.
> > > What about if for example home page of wget is cracked, wget author's
> > > key is stolen, new tarball with "rm -rf /*" is created and signed?
> > >
> >
> > If you put the vendor's signature in the spell that can't happen.
> > Yes thats different than current suggestions for vendor signing, but
> > has come up elsewhere. No need to have extra guru supplied verification.
>
> If the vendor has a compromised key and is not doing anything about it,
> then removing their signature and replacing it with a good hash may be a
> solution.

Or signing the tarball ourselves...

-Andrew

--
__________________________________________________________________________
|Andrew D. Stitt | astitt at sourcemage.org |
|irc: afrayedknot | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus | acedit at armory.com |
|Sorcery Team Lead | ftp://t.armory.com/ |
--------------------------------------------------------------------------




Archive powered by MHonArc 2.6.24.

Top of Page