Public SourceMage Discussion List

[Andrew <afrayedknot AT thefrayedknot.armory.com>]

On Fri, Oct 08, 2004 at 01:47:50PM +0200, Bas van Gils wrote:
> On Fri, Oct 08, 2004 at 03:10:45AM -0700, Andrew wrote:
> [ ... ]
> > Since a number of people depend on stable sorcery to actually be
> > stable I dont exactly want mirrors I have no control over downloading
> > files (through ftp) and mirroring them. 
> [ ... ]
> > Lets analyze a few case scenarios of how someone would hack a large
> > majority of the sourcemage under this scheme of having several sorcery
> > mirrors.
> [ ... ]
> > If we're lucky people will notice and we'll quickly get a fixed
> > stable sorcery out without evil fred or joe's broken sorcery
> > availible. Then we'll scream from the rooftops about how everyone
> > must update their sorcery from somewhere other than the infected
> > mirror (hardly a foolproof process).
> > 
> > If we're unlucky a better part of our userbase will have hacked
> > machines and not even know it.  This will continue for months on
> > end before anyone notices.
> [...]
> > Im certainly not risking all of our work on the trust of some servers
> > I have no control over mirroring the bits I think they're mirroring,
> > let-alone getting those bits via insecure protocols.
> 
> <cynical>
>     Perhaps we should reply on CD-Roms for distributing sorcery?
> </cynical>
> 
> On a serious note, ibilbio-servers work... usually. Things like PGP-signing,
> secure connections for pulling sorcery code, MD5-sums can help to secure it
> all. 
> 

I agree, right now stable/test get to ibiblio through scp plus an extra
md5sum check, which i feel much more comfortable than having the same
bits reloaded via ftp every few hours. In the future there will be gpg
signage (of sorcery and grimoires) which will open the door for using
other "less trusted" sites.

-Andrew


-- 
__________________________________________________________________________
|Andrew D. Stitt                           | astitt at sourcemage.org    |
|irc: afrayedknot                          | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus    |                             |
|Sorcery Team Lead, Porting Team Lead      |                             |
|Grimoire Guru ham/smgl                    | ftp://t.armory.com          |
|Author and Maintainer of Prometheus       |                             |
--------------------------------------------------------------------------

Attachment: pgptru3YtPkVH.pgp
Description: PGP signature