Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

On Wed, Nov 24, 2004 at 11:12:37PM +0100, Bas van Gils wrote:
> On Wed, Nov 24, 2004 at 10:22:16AM -0800, Andrew wrote:
> > On Wed, Nov 24, 2004 at 07:15:53PM +0100, Eric Schabell wrote:
> > > So as we see again, even when you get what you want, it ain't enough...
> > 
> > If you had read my emails on this topic you would have noticed that i
> > pointed out that I would need to have access to the mirrors. If nothing
> > else because of the way mirroring is done. Im sorry you cannot comphrehend
> > my explaination of the security risks inherent in letting just anyone
> > be a mirror.
> 
> It's been a while since I read Andrew's message on the security risks
> involved. Unfortuantely I don't have the time to search through the archive 
> to
> re-read it but... eventhough I'm not an expert I can't help but wonder:
> suppose we *do* have sorcery mirrors, despite the security risks involved.
> Isn't it the responsibility of individual users to *pick* a mirror over the
> default download location for sorcery?
> 
> The point is: on my box, *I* am responsible for security (i.e. firewall,
> patches of ssh etcetera). *I* pick which software I install and *I* choose
> which grimoire from which location I download. why not sorcery?

But the automated install routines should be responsible enough to do 
what they do well enough to confirm the integrity of the source.  Once 
you go into manual mode, correct, responsibility is upon you.

> 
> Perhaps I misunderstood Andrews post but these are my five cents..
> 
> > But again, take your flames elsewhere.
> 
> Quit the bickering. Eric (hay have) had a good point.

His point, that there should be mirrors, is taken well.  Andrew's point 
is also taken well.  Let's take each points for what they are and 
nothing more.

Easy way to exploit hundreds of boxes? Volunteer to be a sorcery mirror.

No, we can't enable that behavior.

We have mirrors for grimoire sources because we have integrity checks in 
the grimoire -- the grimoire comes from a trusted download location.

That's a bit different than trusting anybody to be a sorcery download 
mirror where there is no integrity check on updates.

Seeth

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8  3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: pgpLzV1CRpblw.pgp
Description: PGP signature