Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] md5 checks / possibly compromised openssh tarball

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergeyli AT pisem.net>
  • To: "Julian v. Bock" <julian AT openit.de>
  • Cc: sm-discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] md5 checks / possibly compromised openssh tarball
  • Date: Thu, 01 Aug 2002 08:42:25 -0400

Julian, my friend,

I agree that it's a help, but where's the action here? Who's really concerned about sorcery having this feature? And if nobody finds out about xyz.tar.gz being trojaned because it's not in such a wide use, how will you find out? That makes things worse because it gives you just that: false sense of security. My apartment door is very good, steel frame etc., but I'm damn sure burglars if any would use balcony because it's not very high and has just one simple door (that's why there's no resaleable valuables at home). Making the door stronger in my case doesn't pay. But for SourceMage the perspective is to contain valuable data, so it has to have security which everyone can rely on.

BTW, I think it would hurt to just take the checksum and apply it to _both_ tar and tar.gz/bz2, and see which one matches. But for nes spells, the checksum should be generated against tar.

--Sergey.

Julian v. Bock wrote:

Hi

Just downloaded a "fresh" openssh tarball, and it is actually
compromised. Our spell contained the correct md5 checksum. Anyone left
who thinks that checksum checks don't give additional security?

Julian
_______________________________________________
SM-Discuss mailing list
SM-Discuss AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/sm-discuss









Archive powered by MHonArc 2.6.24.

Top of Page