Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Basesystem Cache files on Mirror

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "David Michael Leo Brown Jr." <dmlb2000 AT excite.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Basesystem Cache files on Mirror
  • Date: Thu, 28 Apr 2005 19:16:17 -0400 (EDT)


>> >
>> > And don't forget that this has potential for a huge security hole, when
>> > some malicious user contributes tarball with modified binary. How are we
>> > supposed to detect such a thing, or prevent it at all? Not that I think
>> > such tarball cache is bad idea, it would save me quite a lot of time
>> > sometimes, but still this security concern is a big one.
>>
>> Perhaps, since there's stuff in sorcery for GPG verification, we could
>> use gpg to verify the tarballs. If the QA Team is going to generate them
>> then they could sign the tarballs and put the signature and the cache on
>> the download site.
>>
>>
>
>But if QA team is to create those tarballs, what is the reason for other
>users to create them? I know, I'm playing devil's advocate here, but there
>are important security issues here and I just don't want my computers to
>fall easy prey to malicious hacker :) I may sound a bit paranoid, but I'm
>managing one server under constant attack (about 20 attempts a day), so
>the paranoia has its own sense :) Not counting other computers where I use
>SourceMage (3 as of now, fourth to be added soon)
>
>If anyone shows me that my concerns are moot, it would be great then. Not
>that I like to be proved wrong, but when good idea turns out to be secure
>idea, the better for everyone.
>

I understand your parinoia but its not like we are going to force people to
use
these cache files they are for repairing broken systems or potentialy a net
install, if you need to use these cache files either you or someone else
violated your system to the point were you can't recover with out them.

I don't understand the circumstances that would result, along with appropriate
gpg checks, in a security violation especially when the machine is in an
unusable state to start with.

- David Brown

_______________________________________________
Join Excite! - http://www.excite.com
The most personalized portal on the Web!




Archive powered by MHonArc 2.6.24.

Top of Page