Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

On Fri, Apr 29, 2005 at 01:06:45AM +0200, Ondra Tomecka wrote:
> On Thu, 28 Apr 2005, David Kowis wrote:
> 
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> > 
> > Ondra Tomecka wrote:
> > > 
> > > And don't forget that this has potential for a huge security hole, when 
> > > some malicious user contributes tarball with modified binary. How are 
> > > we 
> > > supposed to detect such a thing, or prevent it at all? Not that I think 
> > > such tarball cache is bad idea, it would save me quite a lot of time 
> > > sometimes, but still this security concern is a big one.
> > 
> > Perhaps, since there's stuff in sorcery for GPG verification, we could
> > use gpg to verify the tarballs. If the QA Team is going to generate them
> > then they could sign the tarballs and put the signature and the cache on
> > the download site.
> > 
> > 
> 
> But if QA team is to create those tarballs, what is the reason for other 
> users to create them? I know, I'm playing devil's advocate here, but there 
> are important security issues here and I just don't want my computers to 
> fall easy prey to malicious hacker :) I may sound a bit paranoid, but I'm 
> managing one server under constant attack (about 20 attempts a day), so 
> the paranoia has its own sense :) Not counting other computers where I use 
> SourceMage (3 as of now, fourth to be added soon)
> 
> If anyone shows me that my concerns are moot, it would be great then. Not 
> that I like to be proved wrong, but when good idea turns out to be secure 
> idea, the better for everyone.

That's the thing, other users won't be.  The discussion is closed on 
random users contributing binaries for the very reason you bring it up.  
If they want to contribute binaries they have to be on the QA team and 
pass a few background checks (or do it unofficially on their own 
website).

Seth

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id 00BA3AF3 = 8BE0 A72E A47E A92A 0737  F2FF 7A3F 6D3C 00BA 3AF3
Quality Assurance Team Leader; Security Team Member, Leader Emeritus
Linux so advanced, it may as well be magic http://www.sourcemage.org
Elected Coordinating Committee Member, Secretary, and Finances Chair
Pacific Green Party of Oregon - Peace - http://www.pacificgreens.org

Attachment: pgps8Cq5zgdqD.pgp
Description: PGP signature