Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
  • Date: Wed, 31 Aug 2005 19:13:22 -0400

On Wed, 2005-08-31 at 18:06 -0500, Jeremy Blosser (emrys) wrote:
> But we don't install a tainted spell before they figure this out. The
> attack and the solution is the same for hashes or signatures, apart from
> some implementation details.

Agreed.

I removed .5 from the sig score in this scenario because remediation
steps for signatures include all the steps for hashes, and then some.
But it was an illustration anyway, .5 and .99 don't matter much here as
long as it's not 1.0. And even if it's 1.0, the score between hashes and
signatures is even.

Sergey.





Archive powered by MHonArc 2.6.24.

Top of Page