Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Mirrors removed from SORCERY (only smgl central site)

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Andrew <afrayedknot AT thefrayedknot.armory.com>
  • To: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] Mirrors removed from SORCERY (only smgl central site)
  • Date: Fri, 8 Oct 2004 09:58:56 -0700

On Fri, Oct 08, 2004 at 01:47:50PM +0200, Bas van Gils wrote:
> On Fri, Oct 08, 2004 at 03:10:45AM -0700, Andrew wrote:
> [ ... ]
> > Since a number of people depend on stable sorcery to actually be
> > stable I dont exactly want mirrors I have no control over downloading
> > files (through ftp) and mirroring them.
> [ ... ]
> > Lets analyze a few case scenarios of how someone would hack a large
> > majority of the sourcemage under this scheme of having several sorcery
> > mirrors.
> [ ... ]
> > If we're lucky people will notice and we'll quickly get a fixed
> > stable sorcery out without evil fred or joe's broken sorcery
> > availible. Then we'll scream from the rooftops about how everyone
> > must update their sorcery from somewhere other than the infected
> > mirror (hardly a foolproof process).
> >
> > If we're unlucky a better part of our userbase will have hacked
> > machines and not even know it. This will continue for months on
> > end before anyone notices.
> [...]
> > Im certainly not risking all of our work on the trust of some servers
> > I have no control over mirroring the bits I think they're mirroring,
> > let-alone getting those bits via insecure protocols.
>
> <cynical>
> Perhaps we should reply on CD-Roms for distributing sorcery?
> </cynical>
>
> On a serious note, ibilbio-servers work... usually. Things like PGP-signing,
> secure connections for pulling sorcery code, MD5-sums can help to secure it
> all.
>

I agree, right now stable/test get to ibiblio through scp plus an extra
md5sum check, which i feel much more comfortable than having the same
bits reloaded via ftp every few hours. In the future there will be gpg
signage (of sorcery and grimoires) which will open the door for using
other "less trusted" sites.

-Andrew


--
__________________________________________________________________________
|Andrew D. Stitt | astitt at sourcemage.org |
|irc: afrayedknot | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus | |
|Sorcery Team Lead, Porting Team Lead | |
|Grimoire Guru ham/smgl | ftp://t.armory.com |
|Author and Maintainer of Prometheus | |
--------------------------------------------------------------------------

Attachment: pgptru3YtPkVH.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page