Public SourceMage Discussion List

[Marc Greene <marcg AT phreaker.net>]

It seems the best defense against this type of thing is simply keeping
backups on hand. Also, it's probably a good idea as a precaution to
umount any unnecessary filesystems with valuable or critical data before
doing updates. As someone long ago mentioned, there is a great deal of
trust in this whole system. If you think about it, there are a fair
number of people involved in editing the scripts that get run as root on
your computer. The SM users have to trust them to get it right, as well
as think about security from hacks. I mean, if someone successfully
impersonated one of the gurus, or hacked their machine/email account,
then they wouldn't even need direct access to the servers to wreak havoc
on SM users systems. So in addition to the things that Dufflebunk
mentioned, users should probably also be encouraged to take what
precautions they can for themselves so this trust issue won't be so
scary.

Marc

 On Thu, 9 May 2003, Dufflebunk wrote:

> How safe is anyone who installs an RPM or any other packaging system?
> Who's to say the rpm wasn't hacked to have the install part rm -rf / ?
>
> There has been discussion on signing sources and sorcery itself. Do we
> have any news on that from the security team?
>
> There is also work to separate the 'make install' from the rest of the
> cast.
>
> On Thu, 2003-05-08 at 23:58, Bearcat M. Sandor wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > Folks,
> > Asha'man was joking aroudn with me on the irc channel:
> >
> > [21:51:15] <bearcat> hey folks..I didn't see a message on the state of the
> > grimoires, but is it safe
> > to update now?
> > [21:52:04] <hgg> hey bearcat seems to be fine at my end
> > [21:52:13] <bearcat> cool...thanx
> > [21:52:33] <Asha`man> bearcat: no, I replaced the whole thing w/ a short
> > script = 'rm -rf /'
> > [21:52:35] <Asha`man> :)
> > [21:53:11] <bearcat> Asha`man: Oh My God! You killed my Computer! You
> > bastard!!
> > [21:53:40] <Asha`man> haha
> >
> >
> > I got to thinking "How safe are we".  Could someone hack our scripts on 
> > the
> > codex.sourcemage.org and screw everyone who did a sorcery update, by 
> > changing
> > the cast script to delete our systems? What precautions do we have?
> >
> > Bearcat M. Sandor
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.2.1 (GNU/Linux)
> >
> > iD8DBQE+uyeIya+RPo9ly58RAuFfAJ9XhPPpekrQVPixl6qOrZt46wmcTQCgoUFt
> > fkWkCNCS4VitJ6GNcezHMs4=
> > =tcsE
> > -----END PGP SIGNATURE-----
> > _______________________________________________
> > SM-Discuss mailing list
> > SM-Discuss AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/sm-discuss
>
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
>