Public SourceMage Discussion List

["David Michael Leo Brown Jr." <dmlb2000 AT excite.com>]

>> > 
>> > And don't forget that this has potential for a huge security hole, when 
>> > some malicious user contributes tarball with modified binary. How are we 
>> > supposed to detect such a thing, or prevent it at all? Not that I think 
>> > such tarball cache is bad idea, it would save me quite a lot of time 
>> > sometimes, but still this security concern is a big one.
>> 
>> Perhaps, since there's stuff in sorcery for GPG verification, we could
>> use gpg to verify the tarballs. If the QA Team is going to generate them
>> then they could sign the tarballs and put the signature and the cache on
>> the download site.
>> 
>> 
>
>But if QA team is to create those tarballs, what is the reason for other 
>users to create them? I know, I'm playing devil's advocate here, but there 
>are important security issues here and I just don't want my computers to 
>fall easy prey to malicious hacker :) I may sound a bit paranoid, but I'm 
>managing one server under constant attack (about 20 attempts a day), so 
>the paranoia has its own sense :) Not counting other computers where I use 
>SourceMage (3 as of now, fourth to be added soon)
>
>If anyone shows me that my concerns are moot, it would be great then. Not 
>that I like to be proved wrong, but when good idea turns out to be secure 
>idea, the better for everyone.
>

I understand your parinoia but its not like we are going to force people to 
use 
these cache files they are for repairing broken systems or potentialy a net 
install, if you need to use these cache files either you or someone else
violated your system to the point were you can't recover with out them.

I don't understand the circumstances that would result, along with appropriate
gpg checks, in a security violation especially when the machine is in an 
unusable state to start with.

- David Brown

_______________________________________________
Join Excite! - http://www.excite.com
The most personalized portal on the Web!