Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
  • Date: Wed, 31 Aug 2005 17:27:29 -0700

On Wed, Aug 31, 2005 at 07:43:00PM -0400, Sergey A. Lipnevich wrote:
> On Wed, 2005-08-31 at 16:21 -0700, Seth Alan Woolley wrote:
> > On Wed, Aug 31, 2005 at 07:08:07PM -0400, Sergey A. Lipnevich wrote:
> > > On Wed, 2005-08-31 at 15:59 -0700, Andrew wrote:
> > > > There is no keyserver, guru signing keys are not published to any
> > > > keyserver unless the guru wants to, but theres no point to it, the
> > > > keys
> > > > are taken from the gurus.gpg keyring included in the grimoire.
> > >
> > > Well then it's exactly the same as hash values :-), in that until the
> > > grimoire (or keyring) is downloaded, nothing can be checked. If as you
> > > suggest a method exists to alert the user that there's an updated
> > > signature, hashes could be part of this method.
> >
> > (var) UPDATED, (file) HISTORY, (file) SECURITY, (file) ChangeLog are
> > four such methods.
>
> I'm not getting what you say here. But if you're listing objects whose
> change can be detected, then I agree. DETAILS change would detect a new
> hash, and a keyring change would detect a new key.

On an update of the grimoire, those files can alert the user, in
general, of any update. That's all I was saying.

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454 E082 99F0 69DC FDCE E733

Attachment: pgpGELet2Xnog.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page