Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergeyli AT pisem.net>]

Julian, my friend,

I agree that it's a help, but where's the action here? Who's really 
concerned about sorcery having this feature? And if nobody finds out 
about xyz.tar.gz being trojaned because it's not in such a wide use, how 
will you find out? That makes things worse because it gives you just 
that: false sense of security. My apartment door is very good, steel 
frame etc., but I'm damn sure burglars if any would use balcony because 
it's not very high and has just one simple door (that's why there's no 
resaleable valuables at home). Making the door stronger in my case 
doesn't pay. But for SourceMage the perspective is to contain valuable 
data, so it has to have security which everyone can rely on.

BTW, I think it would hurt to just take the checksum and apply it to 
_both_ tar and tar.gz/bz2, and see which one matches. But for nes 
spells, the checksum should be generated against tar.

--Sergey.

Julian v. Bock wrote:

> Hi
>
> Just downloaded a "fresh" openssh tarball, and it is actually
> compromised. Our spell contained the correct md5 checksum. Anyone left
> who thinks that checksum checks don't give additional security?
>
> Julian
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
>
>