Public SourceMage Discussion List

[Dufflebunk <dufflebunk AT dufflebunk.homeip.net>]

How safe is anyone who installs an RPM or any other packaging system?
Who's to say the rpm wasn't hacked to have the install part rm -rf / ?

There has been discussion on signing sources and sorcery itself. Do we
have any news on that from the security team?

There is also work to separate the 'make install' from the rest of the
cast.

On Thu, 2003-05-08 at 23:58, Bearcat M. Sandor wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Folks,
> Asha'man was joking aroudn with me on the irc channel: 
> 
> [21:51:15] <bearcat> hey folks..I didn't see a message on the state of the 
> grimoires, but is it safe 
> to update now?
> [21:52:04] <hgg> hey bearcat seems to be fine at my end
> [21:52:13] <bearcat> cool...thanx
> [21:52:33] <Asha`man> bearcat: no, I replaced the whole thing w/ a short 
> script = 'rm -rf /'
> [21:52:35] <Asha`man> :)
> [21:53:11] <bearcat> Asha`man: Oh My God! You killed my Computer! You 
> bastard!!
> [21:53:40] <Asha`man> haha
> 
> 
> I got to thinking "How safe are we".  Could someone hack our scripts on the 
> codex.sourcemage.org and screw everyone who did a sorcery update, by 
> changing 
> the cast script to delete our systems? What precautions do we have?
> 
> Bearcat M. Sandor
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.1 (GNU/Linux)
> 
> iD8DBQE+uyeIya+RPo9ly58RAuFfAJ9XhPPpekrQVPixl6qOrZt46wmcTQCgoUFt
> fkWkCNCS4VitJ6GNcezHMs4=
> =tcsE
> -----END PGP SIGNATURE-----
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss